release-skill 0.9.5 → 0.9.6

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "release-skill",
       "source": "./",
-      "version": "0.9.5",
+      "version": "0.9.6",
       "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
       "author": {
         "name": "广州市风荷科技有限公司"

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.5",
+  "version": "0.9.6",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codebuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.5",
+  "version": "0.9.6",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.5",
+  "version": "0.9.6",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"
@@ -19,7 +19,7 @@
     ],
     "defaultPrompt": [
       "Assess this project for release readiness.",
-      "Prepare a release plan for version 0.9.5.",
+      "Prepare a release plan for version 0.9.6.",
       "Help me understand the release workflow."
     ]
   }

package/.kimi-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.5",
+  "version": "0.9.6",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.9.6 locale=en baseline=sha256:cc19a29543385bc4fbb52ac576b2310bca4b6963121dce82ada0ac933e237bfd -->
+## [0.9.6] - 2026-09-02
+
+0.9.6 is a local source candidate that adds a public `postverify` CLI for same-lineage postPublish hooks without ship state, and records host-added symlinks in Claude and Codex marketplace install trees without following them. It consumes the three Foundation packages at the exact 0.16.0 release. This note is not evidence of publication, real-host acceptance, consumer installation verification, or independent acceptance.
+
+### Security
+
+- `postverify` binds `planDigest`, the source `VERIFIED` run, each `hookId`, and its immutable hook approval; expired or mismatched approvals fail closed before hook execution, without adding a second state or authority.
+- Declared payload symlinks, frozen-source symlinks, and legacy install-tree symlinks continue to fail closed; host-added symlinks are recorded as raw targets only.
+- Any host plan remains a qualified frozen-plan path and requires a VERIFIED-run from the same release lineage before host acceptance; this source candidate does not provide that acceptance.
+
+### Added
+
+- Add the public `postverify` command for phase-by-phase `prepare` → `approve` → `publish` → `distribute` → `verify` lineages that need to run approved postPublish hooks without a ship state or a second authority.
+- Record host-added symlinks in Claude and Codex marketplace install trees as paths and raw targets without following them, while keeping declared and frozen symlinks fail-closed.
+
+### Changed
+
+- Use Foundation 0.16.0 `createFilesystemRootBinding` and `observeFilesystemTree` in record mode for Claude and Codex marketplace install-tree observation; ordinary files keep the existing comparison, directories stay out of extra installed paths, and the frozen `manifestDigest` remains unchanged.
+- Keep the narrow R-05 Hook cache v2 consumer path and the stable isolated install-tree record path; this candidate does not expand standalone-index or host acceptance support.
+- Retain the explicit CodeBuddy plugin entry (`marketplace: release-skill`) and `--root <project-root>` in release-finish local-finish examples.
+
+### Upgrade Notes
+
+Prepare a new 0.9.6 plan when adopting these changes. The `postverify` command requires the same plan digest, a source `VERIFIED` run, and an immutable approval for each declared hook; an expired or mismatched approval stops before hook execution. Real-host acceptance still requires an officially published and VERIFIED release; the official 0.9.6 entry must be installed or reloaded first. A source candidate, an older installed entry, or the mere existence of plan and run files cannot complete real-host acceptance. Each selected host must complete a first successful update. On the second run, Claude, Kimi, CodeBuddy, and WorkBuddy must report `ALREADY_CURRENT`; Codex may report `UPDATED` only when it reinstalls the same exact 0.9.6 frozen reference, payload validation passes, and `restartRequired=true` is declared. This source candidate does not claim publication, GLAF4 acceptance, Hub postVerify, or consumer-installation verification.
+<!-- release-skill:changelog:end version=0.9.6 locale=en -->
+
 <!-- release-skill:changelog:start version=0.9.5 locale=en baseline=sha256:21c87f71244641b1819ee77ca067f65fd29caa64e42229184cd552b82829d86b -->
 ## [0.9.5] - 2026-09-02
 

package/INSTALL.md

@@ -2,7 +2,7 @@
 
 [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.9.5 -->
+<!-- release-skill:release-version: 0.9.6 -->
 ## Prerequisites
 
 - Node.js 22.0.0 or later
@@ -114,7 +114,7 @@ tag pinned to the exact version (never the bare repository URL, which installs
 the latest release or default branch), confirm the trust prompt, then reload:
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.5
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.6
    /plugins reload
    ```
 

package/INSTALL.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.9.5 -->
+<!-- release-skill:release-version: 0.9.6 -->
 ## 前置条件
 
 - Node.js 22.0.0 或更高版本
@@ -104,7 +104,7 @@ Kimi Code 有交互式插件市场，但**没有可脚本化的非交互安装
 （切勿使用裸仓库地址，它会安装最新 release 或默认分支），确认信任提示后重新加载：
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.5
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.6
    /plugins reload
    ```
 

package/README.md

@@ -2,7 +2,7 @@
 
 [简体中文](README.zh-CN.md) · Installation: [English](INSTALL.md) / [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.9.5 -->
+<!-- release-skill:release-version: 0.9.6 -->
 Release preparation for Claude Code, CodeBuddy, WorkBuddy, Codex, and Kimi Code, with human-edited files kept intact.
 
 release-skill helps a maintainer answer three questions: what will be released,
@@ -14,35 +14,34 @@ Setup surfaces only the deterministic `compactSummary` review view; the full
 report stays in a temporary session directory.
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.9.5** (2026-09-02)
+**0.9.6** (2026-09-02)
 
-0.9.5 is a local source candidate that closes the postVerify-to-local-finish lifecycle, recognizes the supported real host install commands, and tightens standalone-index marketplace identity checks. It consumes the three Foundation packages at the exact 0.16.0 release. This note is not evidence of publication, real-host acceptance, consumer installation verification, or independent acceptance.
+0.9.6 is a local source candidate that adds a public `postverify` CLI for same-lineage postPublish hooks without ship state, and records host-added symlinks in Claude and Codex marketplace install trees without following them. It consumes the three Foundation packages at the exact 0.16.0 release. This note is not evidence of publication, real-host acceptance, consumer installation verification, or independent acceptance.
 
 **Security**
 
-- Local finishing fails closed when the canonical plan or run evidence is missing, mismatched, incomplete, or not linked to the same VERIFIED lineage; host detection and host writes do not start on that path.
+- `postverify` binds `planDigest`, the source `VERIFIED` run, each `hookId`, and its immutable hook approval; expired or mismatched approvals fail closed before hook execution, without adding a second state or authority.
+- Declared payload symlinks, frozen-source symlinks, and legacy install-tree symlinks continue to fail closed; host-added symlinks are recorded as raw targets only.
 - Any host plan remains a qualified frozen-plan path and requires a VERIFIED-run from the same release lineage before host acceptance; this source candidate does not provide that acceptance.
 
 **Added**
 
-- Require completed postVerify evidence, including same-lineage VERIFIED data and every declared checkpoint, before any local host update is probed or executed. Incomplete postVerify evidence returns a bound `ship` continuation when state evidence is available.
-- Add the explicit `manual-index-checkpoint` first-release bootstrap path for Claude and Codex standalone-index distributions. The plan binds the expected plugin identity and leaves the final marketplace index commit pending until verify observes the remote index.
+- Add the public `postverify` command for phase-by-phase `prepare` → `approve` → `publish` → `distribute` → `verify` lineages that need to run approved postPublish hooks without a ship state or a second authority.
+- Record host-added symlinks in Claude and Codex marketplace install trees as paths and raw targets without following them, while keeping declared and frozen symlinks fail-closed.
 
 **Changed**
 
-- Recognize the supported real host install commands and environment boundaries separately for CodeBuddy and WorkBuddy; unsupported WorkBuddy platforms are reported without invoking a host command.
-- Require first-release bootstrap plans to observe an empty plugin repository without the target tag or GitHub Release, then match the marketplace name and selected entry exactly before continuing.
-- Preserve the complete selected marketplace entry metadata for ordinary non-bootstrap remote distributions while deriving verification identity only from the platform-owned fields.
-- The CodeBuddy plugin declares `marketplace: release-skill`, and both release-finish local-finish examples pass `--root <project-root>`.
-- Keep the narrow R-05 Hook cache v2 consumer path in the current 0.9.5 candidate; this does not add a broader Hook cache or host acceptance surface.
+- Use Foundation 0.16.0 `createFilesystemRootBinding` and `observeFilesystemTree` in record mode for Claude and Codex marketplace install-tree observation; ordinary files keep the existing comparison, directories stay out of extra installed paths, and the frozen `manifestDigest` remains unchanged.
+- Keep the narrow R-05 Hook cache v2 consumer path and the stable isolated install-tree record path; this candidate does not expand standalone-index or host acceptance support.
+- Retain the explicit CodeBuddy plugin entry (`marketplace: release-skill`) and `--root <project-root>` in release-finish local-finish examples.
 
 **Upgrade Notes**
 
-Prepare a new 0.9.5 plan when adopting these changes. Complete postVerify with `ship` before running post-release when the checklist reports `COMPLETE_POST_VERIFY`. Real-host acceptance can begin only after 0.9.5 is officially published and VERIFIED; the official 0.9.5 entry must be installed or reloaded first. A source candidate, an older installed entry, or the mere existence of plan and run files cannot complete real-host acceptance. Each selected host must complete a first successful update. On the second run, Claude, Kimi, CodeBuddy, and WorkBuddy must report `ALREADY_CURRENT`; Codex may report `UPDATED` only when it reinstalls the same exact 0.9.5 frozen reference, payload validation passes, and `restartRequired=true` is declared. A first-release bootstrap uses `manual-index-checkpoint` only for Claude or Codex standalone-index distributions and requires a manual index checkpoint during verify; it does not add general standalone-index support. This source candidate does not provide real-host acceptance.
+Prepare a new 0.9.6 plan when adopting these changes. The `postverify` command requires the same plan digest, a source `VERIFIED` run, and an immutable approval for each declared hook; an expired or mismatched approval stops before hook execution. Real-host acceptance still requires an officially published and VERIFIED release; the official 0.9.6 entry must be installed or reloaded first. A source candidate, an older installed entry, or the mere existence of plan and run files cannot complete real-host acceptance. Each selected host must complete a first successful update. On the second run, Claude, Kimi, CodeBuddy, and WorkBuddy must report `ALREADY_CURRENT`; Codex may report `UPDATED` only when it reinstalls the same exact 0.9.6 frozen reference, payload validation passes, and `restartRequired=true` is declared. This source candidate does not claim publication, GLAF4 acceptance, Hub postVerify, or consumer-installation verification.
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **Current boundary:** v0.9.5 is the current source candidate. This README
+> **Current boundary:** v0.9.6 is the current source candidate. This README
 > records intended scope and verification boundaries; it is not evidence of
 > publication, consumer-installation verification, or independent acceptance.
 > Release availability must be established from the corresponding release records
@@ -66,7 +65,7 @@ Prepare a new 0.9.5 plan when adopting these changes. Complete postVerify with `
 > publish global preflight.
 
 <!-- release-skill:capability:safe-first-command -->
-> **Production path verified since the v0.1.1 milestone; v0.9.5 is the current
+> **Production path verified since the v0.1.1 milestone; v0.9.6 is the current
 > source candidate. Its README does not establish publication,
 > consumer-installation verification, or independent acceptance.**
 > The npm-installed CLI is the supported user entry. Source checkout
@@ -95,8 +94,9 @@ checkpoints remain intact and use matching-version recovery. Evidence v1 stays
 read-only; v2 uses a closed top level with phase extensions in `details`.
 Summaries and recovery suggestions are diagnostic, never publication authority.
 
-The current 0.9.5 candidate includes the narrow R-05 Hook cache v2 consumer
-path and the stable isolated install-tree record path (A2/A3). It still
+The current 0.9.6 candidate includes the narrow R-05 Hook cache v2 consumer
+path, the public `postverify` path, and the stable isolated install-tree record
+path (A2/A3). It still
 excludes R-02 safe full-tree inventory, R-10 historical-release verification
 implementation, real Kimi/WorkBuddy public-marketplace installation and
 invocation gates, and an Audit public offline release-record verifier.

package/README.zh-CN.md

@@ -2,41 +2,40 @@
 
 [English](README.md) · 安装指南：[中文](INSTALL.zh-CN.md) / [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.9.5 -->
+<!-- release-skill:release-version: 0.9.6 -->
 面向 Claude Code、CodeBuddy、WorkBuddy、Codex 和 Kimi Code 的发布准备工具，完整保留人工维护的文件内容。
 
 release-skill 帮助维护者回答三个问题：准备发布什么、还有哪些检查未通过、最终发布的内容是什么。它不重新生成、也不回写项目源文件。`prepare` 把每个配置的公开文件复制到隔离快照并验证字节——先冻结并供人工审阅，再从同一份冻结产物发布。`setup` 只显示确定性的 `compactSummary` 审阅视图，完整报告保留在临时会话目录中。
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.9.5** (2026-09-02)
+**0.9.6** (2026-09-02)
 
-0.9.5 是当前本地源码候选，收口 postVerify 到本机收尾的生命周期，识别受支持的真实宿主安装命令，并收紧 standalone-index 市场索引的身份校验。三项 Foundation 依赖均精确消费已发布的 0.16.0。本说明不代表已经发布、完成真实宿主验收、完成消费者安装验证或通过独立验收。
+0.9.6 是当前本地源码候选，新增无需 ship 状态即可处理同一发布谱系 postPublish hook 的公开 `postverify` 命令，并在 Claude 和 Codex 市场安装树中记录宿主新增的 symlink，不跟随链接。三项 Foundation 依赖均精确消费已发布的 0.16.0。本说明不代表已经发布、完成真实宿主验收、完成消费者安装验证或通过独立验收。
 
 **安全**
 
-- canonical plan 或 run 证据缺失、摘要不一致、内容不完整或未连接到同一 VERIFIED 谱系时，本机收尾会失败关闭；该路径不会开始宿主探测或写入。
+- `postverify` 绑定 `planDigest`、源 `VERIFIED` run、每个 `hookId` 和对应的不可变 hook approval；批准过期或不匹配时，在执行 hook 前失败关闭，不增加第二状态或第二权威。
+- 声明载荷 symlink、冻结源码 symlink 和 legacy 安装树 symlink 继续失败关闭；宿主新增 symlink 只记录原始目标。
 - 任何宿主计划都必须是合格冻结计划，并要求同一发布谱系的 VERIFIED run 才能开始宿主验收；本源码候选不提供该验收。
 
 **新增**
 
-- 本机更新前必须先取得同一发布谱系的 VERIFIED 证据，并逐项完成所有已声明 checkpoint；postVerify 尚未完成时不会探测或执行宿主。本机状态证据可用时，待处理路径会返回带绑定信息的 `ship` 续接命令。
-- 为 Claude 和 Codex 的 standalone-index 分发新增显式 `manual-index-checkpoint` 首发引导路径。计划会绑定预期插件身份，并把最终市场索引提交留到 verify 观察远端索引后确定。
+- 新增公开 `postverify` 命令，支持沿 `prepare` → `approve` → `publish` → `distribute` → `verify` 阶段谱系，在没有 ship 状态或第二权威的情况下执行已批准的 postPublish hook。
+- Claude 和 Codex 市场安装树记录宿主新增 symlink 的路径和原始目标，不跟随链接；声明载荷和冻结源码中的 symlink 仍失败关闭。
 
 **变更**
 
-- 分别识别 CodeBuddy 与 WorkBuddy 支持的真实宿主安装命令和环境边界；在不支持 WorkBuddy 的平台上只报告跳过状态，不调用宿主命令。
-- 首发引导计划必须确认插件仓库为空、目标 tag 和 GitHub Release 均不存在，再严格匹配市场名称与选定条目后继续。
-- 普通非 bootstrap 远端分发保留完整的市场条目元数据；身份校验只取平台自有字段生成。
-- CodeBuddy 插件显式声明 `marketplace: release-skill`；两个 release-finish 本机收尾示例都传入 `--root <project-root>`。
-- 当前 0.9.5 候选保留窄范围的 R-05 Hook cache v2 消费路径；本版不扩大 Hook cache 或宿主验收范围。
+- Claude 和 Codex 市场安装树使用 Foundation 0.16.0 的 `createFilesystemRootBinding` 与 record 模式 `observeFilesystemTree`；普通文件继续使用现有比较，目录不进入额外安装路径，冻结的 `manifestDigest` 保持不变。
+- 保留窄范围的 R-05 Hook cache v2 消费路径和稳定的隔离安装树记录路径；本候选不扩展 standalone-index 或宿主验收支持。
+- 保留 CodeBuddy 插件显式的 `marketplace: release-skill` 条目，以及 release-finish 本机收尾示例中的 `--root <project-root>`。
 
 **升级说明**
 
-采用这些改动时请重新准备 0.9.5 计划。清单返回 `COMPLETE_POST_VERIFY` 时，先用 `ship` 完成 postVerify，再运行 post-release。只有 0.9.5 正式发布并达到 VERIFIED，才能开始真实宿主验收；必须先安装或重载正式的 0.9.5 入口。源码候选、旧的已安装入口，或仅存在计划和运行文件，都不能完成真实宿主验收。每个选定宿主都必须先完成首次成功更新。第二次运行时，Claude、Kimi、CodeBuddy 和 WorkBuddy 必须返回 `ALREADY_CURRENT`；Codex 可以使用 `UPDATED`，但只有在重新安装同一精确 0.9.5 冻结引用、载荷验证通过并声明 `restartRequired=true` 时才允许这样返回。首发引导只适用于 Claude 或 Codex 的 standalone-index 分发，并使用 `manual-index-checkpoint`；verify 期间必须完成一次人工索引检查，当前版本不扩展 standalone-index 的通用支持。本源码候选不提供真实宿主验收。
+采用这些改动时请重新准备 0.9.6 计划。`postverify` 要求同一计划摘要、源 `VERIFIED` run，以及每个已声明 hook 的不可变 approval；批准过期或不匹配时会在执行 hook 前停止。真实宿主验收仍要求正式发布并达到 VERIFIED；正式的 0.9.6 入口必须先安装或重载。源码候选、旧的已安装入口，或仅存在计划和运行文件，都不能完成真实宿主验收。每个选定宿主都必须先完成首次成功更新。第二次运行时，Claude、Kimi、CodeBuddy 和 WorkBuddy 必须返回 `ALREADY_CURRENT`；Codex 可以使用 `UPDATED`，但只有在重新安装同一精确 0.9.6 冻结引用、载荷验证通过并声明 `restartRequired=true` 时才允许这样返回。本源码候选不提供该验收，也不代表已经发布、完成 GLAF4 验收、完成 Hub postVerify 或完成消费者安装验证。
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **当前边界：** v0.9.5 只是当前源码候选。本 README 记录预期范围与验证边界，
+> **当前边界：** v0.9.6 只是当前源码候选。本 README 记录预期范围与验证边界，
 > 不代表已经发布、完成消费者安装验证或通过独立验收。
 > 版本可用性以对应发布记录及发布后验证结果为准。
 > v0.4.1 是更早的已发布里程碑（v0.2.2 曾处于已发布状态，后因平台验证收敛修复而更新）。
@@ -52,7 +51,7 @@ release-skill 帮助维护者回答三个问题：准备发布什么、还有哪
 > 远端唯一性检查在 `publish` 全局预检执行。
 
 <!-- release-skill:capability:safe-first-command -->
-> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.9.5 是当前源码候选，本 README 不证明该候选已经发布、完成消费者安装验证或通过独立验收。**
+> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.9.6 是当前源码候选，本 README 不证明该候选已经发布、完成消费者安装验证或通过独立验收。**
 > npm 安装的 CLI 是受支持的用户入口；源码 checkout 保留为开发/贡献者路径。
 >
 > **第一条命令：**
@@ -70,7 +69,7 @@ marketplace 委托目标工作区发布的边界不变。
 
 旧 production 计划缺少 `sourceAuthority` 时，在外部写入前拒绝。未发生外部写入的计划必须重新 prepare 并批准新摘要，不能补写旧计划或迁移批准。已有 `PARTIAL` 保留检查点，走匹配版本的恢复路径。evidence v1 只读；v2 顶层封闭，阶段扩展放在 `details`。摘要和恢复建议只作诊断，不构成发布权威。
 
-当前 0.9.5 候选包含窄范围的 R-05 Hook cache v2 消费路径和稳定隔离安装树记录路径（A2/A3）。当前仍不包含 R-02 安全整树盘点、R-10 历史发布验证的产品实现、真实 Kimi/WorkBuddy 公开市场安装与调用门禁或 Audit 公开离线发布记录验证器。本范围说明不构成远端发布记录或消费者升级指引。
+当前 0.9.6 候选包含窄范围的 R-05 Hook cache v2 消费路径、公开 `postverify` 路径和稳定隔离安装树记录路径（A2/A3）。当前仍不包含 R-02 安全整树盘点、R-10 历史发布验证的产品实现、真实 Kimi/WorkBuddy 公开市场安装与调用门禁或 Audit 公开离线发布记录验证器。本范围说明不构成远端发布记录或消费者升级指引。
 
 Foundation 三包精确依赖已发布的 0.16.0。新生成的 Kimi/CodeBuddy 同仓计划在 verify 阶段调用正式 `runPluginVerification`，把完整冻结载荷交给 Foundation，并记录最小的 `install-only` 观察收据。Kimi 映射为 `kimi-code`，CodeBuddy 映射为兼容的 `workbuddy`。`observed` 与 `payloadMatches` 只表示机制观察结果，不代表远端已发布或 release-skill 已完成领域验证。独立市场来源、真实市场安装和宿主调用仍是人工后续任务。
 

package/adapters/claude/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "release-skill",
       "source": "./",
-      "version": "0.9.5",
+      "version": "0.9.6",
       "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
       "author": {
         "name": "广州市风荷科技有限公司"

package/adapters/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.5",
+  "version": "0.9.6",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/adapters/claude/bin/release-skill.bundle.mjs

@@ -9,9 +9,9 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
 // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
 const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
 // Package identity injected at build time — closure-independent --version probe.
-const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.5"});
+const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.6"});
 // Build-time source digest for the BUNDLE_STALE freshness gate (see above).
-const __bundleSourceDigest = "cbcc967eb1306a8f2e88e404a9ffbdb8bfaf0ffb8863fe8c5521cbb4d44346c1";
+const __bundleSourceDigest = "8fd8e6c5f7796efe9e1f7153382b50c74d78a4b5f836f872837ff2f11e4daeb5";
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -109640,6 +109640,39 @@ function transportPayload(entries) {
     contentDigest
   }));
 }
+function foundationPayloadMembers(observation) {
+  return observation.members.map((member) => {
+    if (member.type === "file") {
+      return {
+        path: member.path,
+        type: member.type,
+        mode: member.statMode & ~146,
+        size: member.bytes,
+        contentDigest: member.sha256
+      };
+    }
+    if (member.type === "directory") {
+      return { path: member.path, type: member.type, mode: member.statMode };
+    }
+    return {
+      path: member.path,
+      type: member.type,
+      mode: member.statMode,
+      size: member.bytes,
+      targetBase64: member.targetBase64
+    };
+  });
+}
+async function observeMarketplaceInstallTree(installPath) {
+  const canonicalInstallPath = await realpath22(installPath);
+  const rootBinding = await createFilesystemRootBinding(canonicalInstallPath);
+  const observation = await observeFilesystemTree({
+    root: canonicalInstallPath,
+    rootBinding,
+    symlinkPolicy: { mode: "record" }
+  });
+  return foundationPayloadMembers(observation);
+}
 function resolveMarketplaceRoot(platform, marketplaceIndexPath) {
   const defaultMarketplace = platform.manifestPaths.marketplace;
   if (!defaultMarketplace) {
@@ -109869,10 +109902,10 @@ async function verifyInstalledMarketplacePayload(action, context, installPath, c
     throw new Error(`unsupported marketplace payload contract: ${JSON.stringify(payloadContract)}`);
   }
   if (payloadContract === PAYLOAD_CONTRACT_DECLARED_MANIFEST || payloadContract === PAYLOAD_CONTRACT_EXTERNAL_MARKETPLACE) {
-    const installedSnapshot2 = await computeFrozenSnapshot(installPath);
+    const installedMembers = await observeMarketplaceInstallTree(installPath);
     const authorityPayload = transportPayload(authorityEntries);
     const installedByPath = new Map(
-      transportPayload(installedSnapshot2.entries).map((entry) => [entry.path, entry])
+      installedMembers.map((entry) => [entry.path, entry])
     );
     const conflicts = [];
     for (const authorityEntry of authorityPayload) {
@@ -109897,11 +109930,19 @@ async function verifyInstalledMarketplacePayload(action, context, installPath, c
       );
     }
     const authorityPaths = new Set(authorityPayload.map((entry) => entry.path));
-    const extraPaths = installedSnapshot2.entries.map((entry) => entry.path).filter((path40) => !authorityPaths.has(path40));
+    const extraMembers = installedMembers.filter((entry) => entry.type !== "directory" && !authorityPaths.has(entry.path));
+    const extraPaths = extraMembers.map((entry) => entry.path);
     const extraInstalledPaths = extraPaths.slice(0, EXTRA_INSTALLED_PATHS_CAP);
+    const extraInstalledLinks = extraMembers.filter((entry) => entry.type === "symlink").slice(0, EXTRA_INSTALLED_PATHS_CAP).map((entry) => ({
+      path: entry.path,
+      targetBase64: entry.targetBase64,
+      bytes: entry.size,
+      statMode: entry.mode
+    }));
     return {
       manifestDigest: action.manifestDigest,
       extraInstalledPaths,
+      ...extraInstalledLinks.length > 0 ? { extraInstalledLinks } : {},
       ...extraPaths.length > EXTRA_INSTALLED_PATHS_CAP ? { extraInstalledPathsTotal: extraPaths.length } : {}
     };
   }
@@ -109917,6 +109958,7 @@ function extraInstalledPathsAudit(binding) {
   if (!binding || !Array.isArray(binding.extraInstalledPaths)) return {};
   return {
     extraInstalledPaths: binding.extraInstalledPaths,
+    ...Array.isArray(binding.extraInstalledLinks) && binding.extraInstalledLinks.length > 0 ? { extraInstalledLinks: binding.extraInstalledLinks } : {},
     ...binding.extraInstalledPathsTotal !== void 0 ? { extraInstalledPathsTotal: binding.extraInstalledPathsTotal } : {}
   };
 }
@@ -112320,6 +112362,7 @@ var init_plugin_marketplace = __esm({
   async "src/adapters/plugin-marketplace.mjs"() {
     init_contract();
     init_installation_contract();
+    init_src2();
     init_frozen();
     await init_registry2();
     await init_kimi();
@@ -112332,6 +112375,8 @@ var init_plugin_marketplace = __esm({
     PAYLOAD_CONTRACT_EXTERNAL_MARKETPLACE = "external-marketplace-v1";
     EXTRA_INSTALLED_PATHS_CAP = 200;
     PAYLOAD_CONFLICT_REPORT_CAP = 10;
+    __name(foundationPayloadMembers, "foundationPayloadMembers");
+    __name(observeMarketplaceInstallTree, "observeMarketplaceInstallTree");
     CONSUMER_INSTALL_RECIPE_VERSION = "consumer-install-v1";
     __name(resolveMarketplaceRoot, "resolveMarketplaceRoot");
     __name(extractDeclaredPluginSource, "extractDeclaredPluginSource");
@@ -145779,7 +145824,7 @@ guardOutputStream(process.stdout);
 guardOutputStream(process.stderr);
 registerPathRedactor(redactSensitivePaths);
 var execFile19 = promisify26(execFileCb22);
-var COMMANDS = /* @__PURE__ */ new Set(["help", "setup", "assess", "prepare", "approve", "publish", "reconcile", "verify", "ship", "post-release", "attest", "hooks", "artifacts", "docs", "distribute", "route", "lineage"]);
+var COMMANDS = /* @__PURE__ */ new Set(["help", "setup", "assess", "prepare", "approve", "publish", "reconcile", "verify", "postverify", "ship", "post-release", "attest", "hooks", "artifacts", "docs", "distribute", "route", "lineage"]);
 function flushOutputStream(stream) {
   if (!stream?.writable || stream.destroyed || stream.writableEnded || outputStreamStates.get(stream)?.failed) {
     return Promise.resolve();
@@ -145970,6 +146015,11 @@ function getCapabilityMaturity() {
       mode: "fresh consumer verification (protocol-tested; no OS/network sandbox)",
       description: "Recheck remote state, exact npm installation, CLI help, and automated Claude/Codex installs before VERIFIED; Kimi/CodeBuddy remain unverified manual follow-ups"
     },
+    postverify: {
+      available: true,
+      mode: "independent postVerify execution",
+      description: "Run approved postVerify hooks from a VERIFIED run in an independent run; never reads or writes ship state"
+    },
     distribute: {
       available: true,
       mode: "controlled production (protocol-tested; no OS/network sandbox)",
@@ -146003,6 +146053,7 @@ Commands:
   publish    Publish frozen GitHub/npm artifacts after approval
   reconcile  Resume PARTIAL state from evidence; conflicts require a human
   verify     Fresh remote and consumer verification; only this reaches VERIFIED
+  postverify Run approved postVerify hooks from a VERIFIED run in an independent run
   ship       Resume one durable prepare -> approve -> publish -> verify flow; completes a parked
              postVerify hook once its checkpoint approval is provided (--hook-approval)
   post-release Inspect optional local finishing work after VERIFIED; update installed host plugins
@@ -146017,10 +146068,10 @@ Commands:
 
 Options:
   --root <path>    Project root directory (default: cwd)
-  --plan <path>    Path to the release plan file
+  --plan <path>    Path to the release plan file (required for approve/publish/reconcile/verify/postverify)
   --run <path>     Path to the release run file, or a run directory whose release-run.json
-                   is resolved automatically (required for reconcile/verify)
-  --approval <path> Path to the approval record
+                   is resolved automatically (required for reconcile/verify/postverify)
+  --approval <path> Path to the release-level approval record (required for publish/postverify)
   --production     Prepare immutable Git/npm production artifacts
   --output <path>  Override prepare/approve output path (non-production only)
   --run-dir <path> Override prepare run directory; production requires one direct child of .release-skill/runs
@@ -146057,7 +146108,7 @@ Options:
   --install-path <path> Actual managed plugin path when closure verification requires it
   --install-channel <desktop|cli> CodeBuddy installation channel when required
   --approve         Approve the ship plan (boolean; plan digest is auto-resolved)
-  --hook-approval <path> Checkpoint approval for a requiresApproval postPublish hook (ship/distribute; repeatable)
+  --hook-approval <path> Checkpoint approval for one requiresApproval hook (ship/distribute/postverify; repeatable)
   --state <path>    Override the durable ship state file
   --update-local-hosts Update installed plugins for selected local hosts after VERIFIED
   --hosts <ids>     Comma-separated local hosts for post-release update. No local host is updated unless --hosts contains at least one id
@@ -147076,6 +147127,117 @@ if (command === "verify") {
     await exitAfterFlush(err.exitCode ?? 1);
   }
 }
+if (command === "postverify") {
+  if (args.includes("--help") || args.includes("-h")) {
+    const helpText = `release-skill postverify - Run approved postVerify hooks from a VERIFIED run
+
+Usage:
+  release-skill postverify [--root <path>] --plan <path> --approval <path> --run <path> [options]
+
+Required options:
+  --plan <path>             Path to the release plan file
+  --approval <path>         Path to the release-level approval record
+  --run <path>              Path to the VERIFIED verify run file or directory
+
+Optional options:
+  --root <path>             Project root directory (default: cwd)
+  --hook-approval <path>    Checkpoint approval for a requiresApproval postVerify hook (repeatable)
+  --json                    Output results as JSON
+  -h, --help                Show this help message and exit
+
+This command creates an independent postVerify run and never reads or writes ship state.`;
+    if (hasJson) {
+      console.log(JSON.stringify({
+        command: "postverify",
+        status: "HELP",
+        usage: "release-skill postverify [--root <path>] --plan <path> --approval <path> --run <path> [options]",
+        options: {
+          "--root": "Project root directory (default: cwd)",
+          "--plan": "Path to the release plan file (required)",
+          "--approval": "Path to the release-level approval record (required)",
+          "--run": "Path to the VERIFIED verify run file or directory (required)",
+          "--hook-approval": "Checkpoint approval for a requiresApproval postVerify hook (repeatable)",
+          "--json": "Output results as JSON",
+          "-h, --help": "Show this help message and exit"
+        },
+        message: "Creates an independent postVerify run and never reads or writes ship state."
+      }, null, 2));
+    } else {
+      console.log(helpText);
+    }
+    await exitAfterFlush(0);
+  }
+  let malformedValuedFlag;
+  const value = /* @__PURE__ */ __name((flag) => {
+    let firstValue;
+    for (let i = 0; i < args.length; i += 1) {
+      if (args[i] !== flag) continue;
+      const next = args[i + 1];
+      if (!next || next.startsWith("-")) {
+        malformedValuedFlag ??= flag;
+        continue;
+      }
+      firstValue ??= next;
+    }
+    return firstValue;
+  }, "value");
+  const root = resolve41(value("--root") ?? process.cwd());
+  const planPath = value("--plan");
+  const approvalPath = value("--approval");
+  const runPath = value("--run");
+  const postpublishApprovalPaths = [];
+  for (let i = 0; i < args.length; i += 1) {
+    if (args[i] === "--hook-approval") {
+      const next = args[i + 1];
+      if (!next || next.startsWith("-")) {
+        malformedValuedFlag ??= "--hook-approval";
+      } else {
+        postpublishApprovalPaths.push(resolve41(next));
+      }
+    }
+  }
+  if (malformedValuedFlag || !planPath || !approvalPath || !runPath) {
+    const msg = "postverify requires --plan <path>, --approval <path>, and --run <path>";
+    if (hasJson) {
+      console.log(JSON.stringify({ error: MISSING_PARAMETERS, message: msg, exitCode: EXIT_CODE_MAP[MISSING_PARAMETERS] }));
+    } else {
+      console.error(`Error: ${msg}`);
+    }
+    await exitAfterFlush(EXIT_CODE_MAP[MISSING_PARAMETERS]);
+  }
+  try {
+    const { postVerifyRelease: postVerifyRelease2 } = await init_postverify().then(() => postverify_exports);
+    const result2 = await postVerifyRelease2({
+      planPath: resolve41(planPath),
+      approvalPath: resolve41(approvalPath),
+      sourceRunPath: resolve41(runPath),
+      root,
+      ...postpublishApprovalPaths.length > 0 ? { postpublishApprovalPaths } : {}
+    });
+    if (hasJson) {
+      console.log(JSON.stringify(result2, null, 2));
+    } else {
+      console.log(`PostVerify status: ${result2.status}`);
+      for (const cp4 of result2.checkpoints ?? []) {
+        console.log(`  ${cp4.actionId}: ${cp4.status}`);
+      }
+      if (result2.runPath) console.log(`PostVerify run: ${result2.runPath}`);
+    }
+    await exitAfterFlush(result2.status === "DISTRIBUTED" ? 0 : 1);
+  } catch (err) {
+    if (hasJson) {
+      console.log(JSON.stringify({
+        error: err.code ?? "UNKNOWN_ERROR",
+        message: err.message,
+        details: err.details ?? {},
+        exitCode: err.exitCode ?? 1
+      }));
+    } else {
+      console.error(`Error: ${err.message}`);
+    }
+    await exitAfterFlush(err.exitCode ?? 1);
+  }
+}
 if (command === "publish") {
   const rootIdx = args.indexOf("--root");
   const rawRoot = rootIdx !== -1 && args[rootIdx + 1] ? args[rootIdx + 1] : process.cwd();

package/adapters/claude/skills/release-help/SKILL.md

@@ -12,7 +12,7 @@ description: "Discoverable entry point for release-skill: dependency and environ
 ## 职责
 
 - 依赖和环境检查：Node.js >= 22、Git 决定本地准备就绪度；npm/gh 另行决定生产依赖就绪度
-- 能力说明：缺少配置时走 `help → setup → assess`；已有配置的安全默认路径是 `help → assess → prepare --offline`；日常生产发布优先使用可恢复的 `ship`，兼容的分阶段闭环仍是 `prepare --online --production → approve → publish → verify`。冻结计划批准是正常发布级流程的唯一批准门；声明 `requiresApproval: true` 的 postPublish hook 仍须等待独立 checkpoint 批准。若计划声明 `postVerify` hook，本机收尾必须等待 `ship` 产出的完成 postVerify run，不能把仅有 `VERIFIED` 的 verify run 当作本机收尾授权。核心发布流程跨平台，WorkBuddy 本机收尾仅支持 macOS
+- 能力说明：缺少配置时走 `help → setup → assess`；已有配置的安全默认路径是 `help → assess → prepare --offline`；日常生产发布优先使用可恢复的 `ship`，兼容的分阶段闭环仍是 `prepare --online --production → approve → publish → verify`。冻结计划批准是正常发布级流程的唯一批准门；声明 `requiresApproval: true` 的 postPublish hook 仍须等待独立 checkpoint 批准。若计划声明 `postVerify` hook，可用 `postverify` 直接执行独立收尾 run，也可由 `ship` 编排该阶段；本机收尾必须等待完成的 postVerify run，不能把仅有 `VERIFIED` 的 verify run 当作本机收尾授权。核心发布流程跨平台，WorkBuddy 本机收尾仅支持 macOS
 - 最小示例：展示从 release-help 到 release-assess 的最短路径
 - 只读诊断：运行 dry-run 检查，不修改任何文件
 - 故障引导：根据错误码指向对应的修复 Skill
@@ -51,6 +51,10 @@ node "${CLAUDE_PLUGIN_ROOT}/bin/release-skill.mjs" ship --root <path> --target-v
 # 多发布单元项目显式选择本轮范围；未传 --unit 时仍为全部单元
 node "${CLAUDE_PLUGIN_ROOT}/bin/release-skill.mjs" ship --root <path> \
   --target-version <version> --unit <unit-a> --unit <unit-b> --json
+# 对已经 VERIFIED 的计划独立执行 postVerify hook；不读取或写入 ship state
+node "${CLAUDE_PLUGIN_ROOT}/bin/release-skill.mjs" postverify --root <path> \
+  --plan <plan-path> --approval <approval-path> --run <verified-run-path> \
+  --hook-approval <immutable-hook-approval-path> --json
 # 开发阶段执行声明 hooks 并生成 prepare 可复用的内容绑定收据
 # 配置时刻即授权（FM-16 处置 A）：hook 是任意本地进程、无隔离、触发前无确认点，
 # 命令调用本身即授权执行配置中的 hooks