release-skill 0.9.5 → 0.9.6

package/adapters/workbuddy/skills/release-verify/SKILL.md

@@ -15,6 +15,11 @@ verify 是发布流程的最终验证阶段，是唯一能将状态提升到 `VE
 它执行远端状态重检、精确 npm 安装烟雾测试和消费者插件安装验证。
 verify 只接受 `PUBLISHED` 状态的源 run；`VERIFIED` 是终态，不会再次派生运行。
 
+计划声明 `postVerify` hook 时，`postverify` 命令负责执行独立的收尾阶段。它接收
+`VERIFIED` verify run、同一计划的 approval，以及逐个传入的 checkpoint approval，
+然后原样调用现有 `postVerifyRelease`。该命令产生独立的 `postverify` run，不读取或写入
+ship state；hook approval 缺失、错误或过期时，在 hook 执行前失败关闭。
+
 **注意**: distribute gate (W1) 已经实现并集成在标准 verify 流程中。verify 现在会检查 postPublish 分发状态（git mirror + marketplace index），只有当所有外部动作都完成并通过验证时才达到 VERIFIED。
 
 **工作流兼容性**: 
@@ -45,13 +50,17 @@ verify 只接受 `PUBLISHED` 状态的源 run；`VERIFIED` 是终态，不会再
 2. 使用插件根相对路径运行 CLI；命令调用本身即授权执行已配置的 verification gate 和 smoke process
 3. 检查 exit code 和结构化状态：`VERIFIED`（全部通过）/ 失败（具体错误）
 4. 只有 `VERIFIED` 才是发布 happy end
-5. 达到 `VERIFIED` 后先检查计划是否声明 `postVerify` hook：有未完成 hook 时，先按 approval 合同批准并通过 `ship` 完成 postVerify，再把最终 `DISTRIBUTED` postVerify run 路径交给 `release-finish`；没有 postVerify hook 时，才把当前 verify run 路径交给 `release-finish`。随后按清单主动询问分支合并和本机宿主插件更新；发布策略已包含分支动作时略过合并询问
+5. 达到 `VERIFIED` 后先检查计划是否声明 `postVerify` hook：直接收尾使用独立的 `postverify --plan --approval --run --hook-approval`，由该命令产生 `DISTRIBUTED` postVerify run；若仍由持久化 ship state 承担编排，则使用 `ship --hook-approval` 完成同一阶段，再把最终 run 路径交给 `release-finish`。没有 postVerify hook 时，把当前 verify run 路径交给 `release-finish`。随后按清单主动询问分支合并和本机宿主插件更新；发布策略已包含分支动作时略过合并询问
 
 ## 确定性脚本调用
 
 ```bash
 # 从插件根运行
 node "${CODEBUDDY_PLUGIN_ROOT}/bin/release-skill.mjs" verify --root <path> --plan <plan-path> --run <run-path> --json
+# 独立执行已 VERIFIED 计划的 postVerify hook；每个 requiresApproval hook 单独传入批准记录
+node "${CODEBUDDY_PLUGIN_ROOT}/bin/release-skill.mjs" postverify --root <path> \
+  --plan <plan-path> --approval <approval-path> --run <verified-run-path> \
+  --hook-approval <immutable-hook-approval-path> --json
 ```
 
 ## 验证步骤
@@ -63,6 +72,9 @@ node "${CODEBUDDY_PLUGIN_ROOT}/bin/release-skill.mjs" verify --root <path> --pla
 5. 对 Claude/Codex marketplace distribution 执行全新隔离消费者安装验证；收集 Kimi/CodeBuddy 的非阻塞 `manualFollowUps`
 6. 全部通过 → `VERIFIED`
 
+`postverify` 不属于上述远端验证步骤。它只处理已经达到 `VERIFIED` 的计划，并把
+`postVerify` 阶段的执行结果写入独立 run。
+
 ## 发布后收尾
 
 `VERIFIED` 不代表要自动修改开发分支或本机宿主。进入 `release-finish` 后，只有用户明确同意，才执行对应的本地动作。本机插件更新失败不会改变发布终态。

package/bin/release-skill-cli.mjs

@@ -5,7 +5,7 @@ import { basename, dirname, join, resolve } from 'node:path';
 import { execFile as execFileCb } from 'node:child_process';
 import { promisify } from 'node:util';
 import { parseNodeMajor, meetsMinimum, computeReadinessStatus } from '../src/core/node-version.mjs';
-import { registerPathRedactor } from '../src/core/errors.mjs';
+import { EXIT_CODE_MAP, MISSING_PARAMETERS, registerPathRedactor } from '../src/core/errors.mjs';
 import { redactSensitivePaths } from '../src/core/redact.mjs';
 
 // Process output errors can be emitted immediately after a large console
@@ -37,7 +37,7 @@ registerPathRedactor(redactSensitivePaths);
 
 const execFile = promisify(execFileCb);
 
-const COMMANDS = new Set(['help', 'setup', 'assess', 'prepare', 'approve', 'publish', 'reconcile', 'verify', 'ship', 'post-release', 'attest', 'hooks', 'artifacts', 'docs', 'distribute', 'route', 'lineage']);
+const COMMANDS = new Set(['help', 'setup', 'assess', 'prepare', 'approve', 'publish', 'reconcile', 'verify', 'postverify', 'ship', 'post-release', 'attest', 'hooks', 'artifacts', 'docs', 'distribute', 'route', 'lineage']);
 
 /**
  * Wait until writes already queued on a process output stream have reached
@@ -307,6 +307,11 @@ function getCapabilityMaturity() {
       mode: 'fresh consumer verification (protocol-tested; no OS/network sandbox)',
       description: 'Recheck remote state, exact npm installation, CLI help, and automated Claude/Codex installs before VERIFIED; Kimi/CodeBuddy remain unverified manual follow-ups',
     },
+    postverify: {
+      available: true,
+      mode: 'independent postVerify execution',
+      description: 'Run approved postVerify hooks from a VERIFIED run in an independent run; never reads or writes ship state',
+    },
     distribute: {
       available: true,
       mode: 'controlled production (protocol-tested; no OS/network sandbox)',
@@ -340,6 +345,7 @@ Commands:
   publish    Publish frozen GitHub/npm artifacts after approval
   reconcile  Resume PARTIAL state from evidence; conflicts require a human
   verify     Fresh remote and consumer verification; only this reaches VERIFIED
+  postverify Run approved postVerify hooks from a VERIFIED run in an independent run
   ship       Resume one durable prepare -> approve -> publish -> verify flow; completes a parked
              postVerify hook once its checkpoint approval is provided (--hook-approval)
   post-release Inspect optional local finishing work after VERIFIED; update installed host plugins
@@ -354,10 +360,10 @@ Commands:
 
 Options:
   --root <path>    Project root directory (default: cwd)
-  --plan <path>    Path to the release plan file
+  --plan <path>    Path to the release plan file (required for approve/publish/reconcile/verify/postverify)
   --run <path>     Path to the release run file, or a run directory whose release-run.json
-                   is resolved automatically (required for reconcile/verify)
-  --approval <path> Path to the approval record
+                   is resolved automatically (required for reconcile/verify/postverify)
+  --approval <path> Path to the release-level approval record (required for publish/postverify)
   --production     Prepare immutable Git/npm production artifacts
   --output <path>  Override prepare/approve output path (non-production only)
   --run-dir <path> Override prepare run directory; production requires one direct child of .release-skill/runs
@@ -394,7 +400,7 @@ Options:
   --install-path <path> Actual managed plugin path when closure verification requires it
   --install-channel <desktop|cli> CodeBuddy installation channel when required
   --approve         Approve the ship plan (boolean; plan digest is auto-resolved)
-  --hook-approval <path> Checkpoint approval for a requiresApproval postPublish hook (ship/distribute; repeatable)
+  --hook-approval <path> Checkpoint approval for one requiresApproval hook (ship/distribute/postverify; repeatable)
   --state <path>    Override the durable ship state file
   --update-local-hosts Update installed plugins for selected local hosts after VERIFIED
   --hosts <ids>     Comma-separated local hosts for post-release update. No local host is updated unless --hosts contains at least one id
@@ -1539,6 +1545,124 @@ if (command === 'verify') {
   }
 }
 
+// --- PostVerify command routing ---
+if (command === 'postverify') {
+  if (args.includes('--help') || args.includes('-h')) {
+    const helpText = `release-skill postverify - Run approved postVerify hooks from a VERIFIED run
+
+Usage:
+  release-skill postverify [--root <path>] --plan <path> --approval <path> --run <path> [options]
+
+Required options:
+  --plan <path>             Path to the release plan file
+  --approval <path>         Path to the release-level approval record
+  --run <path>              Path to the VERIFIED verify run file or directory
+
+Optional options:
+  --root <path>             Project root directory (default: cwd)
+  --hook-approval <path>    Checkpoint approval for a requiresApproval postVerify hook (repeatable)
+  --json                    Output results as JSON
+  -h, --help                Show this help message and exit
+
+This command creates an independent postVerify run and never reads or writes ship state.`;
+    if (hasJson) {
+      console.log(JSON.stringify({
+        command: 'postverify',
+        status: 'HELP',
+        usage: 'release-skill postverify [--root <path>] --plan <path> --approval <path> --run <path> [options]',
+        options: {
+          '--root': 'Project root directory (default: cwd)',
+          '--plan': 'Path to the release plan file (required)',
+          '--approval': 'Path to the release-level approval record (required)',
+          '--run': 'Path to the VERIFIED verify run file or directory (required)',
+          '--hook-approval': 'Checkpoint approval for a requiresApproval postVerify hook (repeatable)',
+          '--json': 'Output results as JSON',
+          '-h, --help': 'Show this help message and exit',
+        },
+        message: 'Creates an independent postVerify run and never reads or writes ship state.',
+      }, null, 2));
+    } else {
+      console.log(helpText);
+    }
+    await exitAfterFlush(0);
+  }
+
+  let malformedValuedFlag;
+  const value = (flag) => {
+    let firstValue;
+    for (let i = 0; i < args.length; i += 1) {
+      if (args[i] !== flag) continue;
+      const next = args[i + 1];
+      if (!next || next.startsWith('-')) {
+        malformedValuedFlag ??= flag;
+        continue;
+      }
+      firstValue ??= next;
+    }
+    return firstValue;
+  };
+  const root = resolve(value('--root') ?? process.cwd());
+  const planPath = value('--plan');
+  const approvalPath = value('--approval');
+  const runPath = value('--run');
+  const postpublishApprovalPaths = [];
+  for (let i = 0; i < args.length; i += 1) {
+    if (args[i] === '--hook-approval') {
+      const next = args[i + 1];
+      if (!next || next.startsWith('-')) {
+        malformedValuedFlag ??= '--hook-approval';
+      } else {
+        postpublishApprovalPaths.push(resolve(next));
+      }
+    }
+  }
+
+  if (malformedValuedFlag || !planPath || !approvalPath || !runPath) {
+    const msg = 'postverify requires --plan <path>, --approval <path>, and --run <path>';
+    if (hasJson) {
+      console.log(JSON.stringify({ error: MISSING_PARAMETERS, message: msg, exitCode: EXIT_CODE_MAP[MISSING_PARAMETERS] }));
+    } else {
+      console.error(`Error: ${msg}`);
+    }
+    await exitAfterFlush(EXIT_CODE_MAP[MISSING_PARAMETERS]);
+  }
+
+  try {
+    const { postVerifyRelease } = await import('../src/commands/postverify.mjs');
+    const result = await postVerifyRelease({
+      planPath: resolve(planPath),
+      approvalPath: resolve(approvalPath),
+      sourceRunPath: resolve(runPath),
+      root,
+      ...(postpublishApprovalPaths.length > 0 ? { postpublishApprovalPaths } : {}),
+    });
+
+    if (hasJson) {
+      console.log(JSON.stringify(result, null, 2));
+    } else {
+      console.log(`PostVerify status: ${result.status}`);
+      for (const cp of result.checkpoints ?? []) {
+        console.log(`  ${cp.actionId}: ${cp.status}`);
+      }
+      if (result.runPath) console.log(`PostVerify run: ${result.runPath}`);
+    }
+
+    await exitAfterFlush(result.status === 'DISTRIBUTED' ? 0 : 1);
+  } catch (err) {
+    if (hasJson) {
+      console.log(JSON.stringify({
+        error: err.code ?? 'UNKNOWN_ERROR',
+        message: err.message,
+        details: err.details ?? {},
+        exitCode: err.exitCode ?? 1,
+      }));
+    } else {
+      console.error(`Error: ${err.message}`);
+    }
+    await exitAfterFlush(err.exitCode ?? 1);
+  }
+}
+
 // --- Publish command routing ---
 if (command === 'publish') {
 

package/bin/release-skill.bundle.mjs

@@ -9,9 +9,9 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
 // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
 const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
 // Package identity injected at build time — closure-independent --version probe.
-const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.5"});
+const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.6"});
 // Build-time source digest for the BUNDLE_STALE freshness gate (see above).
-const __bundleSourceDigest = "cbcc967eb1306a8f2e88e404a9ffbdb8bfaf0ffb8863fe8c5521cbb4d44346c1";
+const __bundleSourceDigest = "8fd8e6c5f7796efe9e1f7153382b50c74d78a4b5f836f872837ff2f11e4daeb5";
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -109640,6 +109640,39 @@ function transportPayload(entries) {
     contentDigest
   }));
 }
+function foundationPayloadMembers(observation) {
+  return observation.members.map((member) => {
+    if (member.type === "file") {
+      return {
+        path: member.path,
+        type: member.type,
+        mode: member.statMode & ~146,
+        size: member.bytes,
+        contentDigest: member.sha256
+      };
+    }
+    if (member.type === "directory") {
+      return { path: member.path, type: member.type, mode: member.statMode };
+    }
+    return {
+      path: member.path,
+      type: member.type,
+      mode: member.statMode,
+      size: member.bytes,
+      targetBase64: member.targetBase64
+    };
+  });
+}
+async function observeMarketplaceInstallTree(installPath) {
+  const canonicalInstallPath = await realpath22(installPath);
+  const rootBinding = await createFilesystemRootBinding(canonicalInstallPath);
+  const observation = await observeFilesystemTree({
+    root: canonicalInstallPath,
+    rootBinding,
+    symlinkPolicy: { mode: "record" }
+  });
+  return foundationPayloadMembers(observation);
+}
 function resolveMarketplaceRoot(platform, marketplaceIndexPath) {
   const defaultMarketplace = platform.manifestPaths.marketplace;
   if (!defaultMarketplace) {
@@ -109869,10 +109902,10 @@ async function verifyInstalledMarketplacePayload(action, context, installPath, c
     throw new Error(`unsupported marketplace payload contract: ${JSON.stringify(payloadContract)}`);
   }
   if (payloadContract === PAYLOAD_CONTRACT_DECLARED_MANIFEST || payloadContract === PAYLOAD_CONTRACT_EXTERNAL_MARKETPLACE) {
-    const installedSnapshot2 = await computeFrozenSnapshot(installPath);
+    const installedMembers = await observeMarketplaceInstallTree(installPath);
     const authorityPayload = transportPayload(authorityEntries);
     const installedByPath = new Map(
-      transportPayload(installedSnapshot2.entries).map((entry) => [entry.path, entry])
+      installedMembers.map((entry) => [entry.path, entry])
     );
     const conflicts = [];
     for (const authorityEntry of authorityPayload) {
@@ -109897,11 +109930,19 @@ async function verifyInstalledMarketplacePayload(action, context, installPath, c
       );
     }
     const authorityPaths = new Set(authorityPayload.map((entry) => entry.path));
-    const extraPaths = installedSnapshot2.entries.map((entry) => entry.path).filter((path40) => !authorityPaths.has(path40));
+    const extraMembers = installedMembers.filter((entry) => entry.type !== "directory" && !authorityPaths.has(entry.path));
+    const extraPaths = extraMembers.map((entry) => entry.path);
     const extraInstalledPaths = extraPaths.slice(0, EXTRA_INSTALLED_PATHS_CAP);
+    const extraInstalledLinks = extraMembers.filter((entry) => entry.type === "symlink").slice(0, EXTRA_INSTALLED_PATHS_CAP).map((entry) => ({
+      path: entry.path,
+      targetBase64: entry.targetBase64,
+      bytes: entry.size,
+      statMode: entry.mode
+    }));
     return {
       manifestDigest: action.manifestDigest,
       extraInstalledPaths,
+      ...extraInstalledLinks.length > 0 ? { extraInstalledLinks } : {},
       ...extraPaths.length > EXTRA_INSTALLED_PATHS_CAP ? { extraInstalledPathsTotal: extraPaths.length } : {}
     };
   }
@@ -109917,6 +109958,7 @@ function extraInstalledPathsAudit(binding) {
   if (!binding || !Array.isArray(binding.extraInstalledPaths)) return {};
   return {
     extraInstalledPaths: binding.extraInstalledPaths,
+    ...Array.isArray(binding.extraInstalledLinks) && binding.extraInstalledLinks.length > 0 ? { extraInstalledLinks: binding.extraInstalledLinks } : {},
     ...binding.extraInstalledPathsTotal !== void 0 ? { extraInstalledPathsTotal: binding.extraInstalledPathsTotal } : {}
   };
 }
@@ -112320,6 +112362,7 @@ var init_plugin_marketplace = __esm({
   async "src/adapters/plugin-marketplace.mjs"() {
     init_contract();
     init_installation_contract();
+    init_src2();
     init_frozen();
     await init_registry2();
     await init_kimi();
@@ -112332,6 +112375,8 @@ var init_plugin_marketplace = __esm({
     PAYLOAD_CONTRACT_EXTERNAL_MARKETPLACE = "external-marketplace-v1";
     EXTRA_INSTALLED_PATHS_CAP = 200;
     PAYLOAD_CONFLICT_REPORT_CAP = 10;
+    __name(foundationPayloadMembers, "foundationPayloadMembers");
+    __name(observeMarketplaceInstallTree, "observeMarketplaceInstallTree");
     CONSUMER_INSTALL_RECIPE_VERSION = "consumer-install-v1";
     __name(resolveMarketplaceRoot, "resolveMarketplaceRoot");
     __name(extractDeclaredPluginSource, "extractDeclaredPluginSource");
@@ -145779,7 +145824,7 @@ guardOutputStream(process.stdout);
 guardOutputStream(process.stderr);
 registerPathRedactor(redactSensitivePaths);
 var execFile19 = promisify26(execFileCb22);
-var COMMANDS = /* @__PURE__ */ new Set(["help", "setup", "assess", "prepare", "approve", "publish", "reconcile", "verify", "ship", "post-release", "attest", "hooks", "artifacts", "docs", "distribute", "route", "lineage"]);
+var COMMANDS = /* @__PURE__ */ new Set(["help", "setup", "assess", "prepare", "approve", "publish", "reconcile", "verify", "postverify", "ship", "post-release", "attest", "hooks", "artifacts", "docs", "distribute", "route", "lineage"]);
 function flushOutputStream(stream) {
   if (!stream?.writable || stream.destroyed || stream.writableEnded || outputStreamStates.get(stream)?.failed) {
     return Promise.resolve();
@@ -145970,6 +146015,11 @@ function getCapabilityMaturity() {
       mode: "fresh consumer verification (protocol-tested; no OS/network sandbox)",
       description: "Recheck remote state, exact npm installation, CLI help, and automated Claude/Codex installs before VERIFIED; Kimi/CodeBuddy remain unverified manual follow-ups"
     },
+    postverify: {
+      available: true,
+      mode: "independent postVerify execution",
+      description: "Run approved postVerify hooks from a VERIFIED run in an independent run; never reads or writes ship state"
+    },
     distribute: {
       available: true,
       mode: "controlled production (protocol-tested; no OS/network sandbox)",
@@ -146003,6 +146053,7 @@ Commands:
   publish    Publish frozen GitHub/npm artifacts after approval
   reconcile  Resume PARTIAL state from evidence; conflicts require a human
   verify     Fresh remote and consumer verification; only this reaches VERIFIED
+  postverify Run approved postVerify hooks from a VERIFIED run in an independent run
   ship       Resume one durable prepare -> approve -> publish -> verify flow; completes a parked
              postVerify hook once its checkpoint approval is provided (--hook-approval)
   post-release Inspect optional local finishing work after VERIFIED; update installed host plugins
@@ -146017,10 +146068,10 @@ Commands:
 
 Options:
   --root <path>    Project root directory (default: cwd)
-  --plan <path>    Path to the release plan file
+  --plan <path>    Path to the release plan file (required for approve/publish/reconcile/verify/postverify)
   --run <path>     Path to the release run file, or a run directory whose release-run.json
-                   is resolved automatically (required for reconcile/verify)
-  --approval <path> Path to the approval record
+                   is resolved automatically (required for reconcile/verify/postverify)
+  --approval <path> Path to the release-level approval record (required for publish/postverify)
   --production     Prepare immutable Git/npm production artifacts
   --output <path>  Override prepare/approve output path (non-production only)
   --run-dir <path> Override prepare run directory; production requires one direct child of .release-skill/runs
@@ -146057,7 +146108,7 @@ Options:
   --install-path <path> Actual managed plugin path when closure verification requires it
   --install-channel <desktop|cli> CodeBuddy installation channel when required
   --approve         Approve the ship plan (boolean; plan digest is auto-resolved)
-  --hook-approval <path> Checkpoint approval for a requiresApproval postPublish hook (ship/distribute; repeatable)
+  --hook-approval <path> Checkpoint approval for one requiresApproval hook (ship/distribute/postverify; repeatable)
   --state <path>    Override the durable ship state file
   --update-local-hosts Update installed plugins for selected local hosts after VERIFIED
   --hosts <ids>     Comma-separated local hosts for post-release update. No local host is updated unless --hosts contains at least one id
@@ -147076,6 +147127,117 @@ if (command === "verify") {
     await exitAfterFlush(err.exitCode ?? 1);
   }
 }
+if (command === "postverify") {
+  if (args.includes("--help") || args.includes("-h")) {
+    const helpText = `release-skill postverify - Run approved postVerify hooks from a VERIFIED run
+
+Usage:
+  release-skill postverify [--root <path>] --plan <path> --approval <path> --run <path> [options]
+
+Required options:
+  --plan <path>             Path to the release plan file
+  --approval <path>         Path to the release-level approval record
+  --run <path>              Path to the VERIFIED verify run file or directory
+
+Optional options:
+  --root <path>             Project root directory (default: cwd)
+  --hook-approval <path>    Checkpoint approval for a requiresApproval postVerify hook (repeatable)
+  --json                    Output results as JSON
+  -h, --help                Show this help message and exit
+
+This command creates an independent postVerify run and never reads or writes ship state.`;
+    if (hasJson) {
+      console.log(JSON.stringify({
+        command: "postverify",
+        status: "HELP",
+        usage: "release-skill postverify [--root <path>] --plan <path> --approval <path> --run <path> [options]",
+        options: {
+          "--root": "Project root directory (default: cwd)",
+          "--plan": "Path to the release plan file (required)",
+          "--approval": "Path to the release-level approval record (required)",
+          "--run": "Path to the VERIFIED verify run file or directory (required)",
+          "--hook-approval": "Checkpoint approval for a requiresApproval postVerify hook (repeatable)",
+          "--json": "Output results as JSON",
+          "-h, --help": "Show this help message and exit"
+        },
+        message: "Creates an independent postVerify run and never reads or writes ship state."
+      }, null, 2));
+    } else {
+      console.log(helpText);
+    }
+    await exitAfterFlush(0);
+  }
+  let malformedValuedFlag;
+  const value = /* @__PURE__ */ __name((flag) => {
+    let firstValue;
+    for (let i = 0; i < args.length; i += 1) {
+      if (args[i] !== flag) continue;
+      const next = args[i + 1];
+      if (!next || next.startsWith("-")) {
+        malformedValuedFlag ??= flag;
+        continue;
+      }
+      firstValue ??= next;
+    }
+    return firstValue;
+  }, "value");
+  const root = resolve41(value("--root") ?? process.cwd());
+  const planPath = value("--plan");
+  const approvalPath = value("--approval");
+  const runPath = value("--run");
+  const postpublishApprovalPaths = [];
+  for (let i = 0; i < args.length; i += 1) {
+    if (args[i] === "--hook-approval") {
+      const next = args[i + 1];
+      if (!next || next.startsWith("-")) {
+        malformedValuedFlag ??= "--hook-approval";
+      } else {
+        postpublishApprovalPaths.push(resolve41(next));
+      }
+    }
+  }
+  if (malformedValuedFlag || !planPath || !approvalPath || !runPath) {
+    const msg = "postverify requires --plan <path>, --approval <path>, and --run <path>";
+    if (hasJson) {
+      console.log(JSON.stringify({ error: MISSING_PARAMETERS, message: msg, exitCode: EXIT_CODE_MAP[MISSING_PARAMETERS] }));
+    } else {
+      console.error(`Error: ${msg}`);
+    }
+    await exitAfterFlush(EXIT_CODE_MAP[MISSING_PARAMETERS]);
+  }
+  try {
+    const { postVerifyRelease: postVerifyRelease2 } = await init_postverify().then(() => postverify_exports);
+    const result2 = await postVerifyRelease2({
+      planPath: resolve41(planPath),
+      approvalPath: resolve41(approvalPath),
+      sourceRunPath: resolve41(runPath),
+      root,
+      ...postpublishApprovalPaths.length > 0 ? { postpublishApprovalPaths } : {}
+    });
+    if (hasJson) {
+      console.log(JSON.stringify(result2, null, 2));
+    } else {
+      console.log(`PostVerify status: ${result2.status}`);
+      for (const cp4 of result2.checkpoints ?? []) {
+        console.log(`  ${cp4.actionId}: ${cp4.status}`);
+      }
+      if (result2.runPath) console.log(`PostVerify run: ${result2.runPath}`);
+    }
+    await exitAfterFlush(result2.status === "DISTRIBUTED" ? 0 : 1);
+  } catch (err) {
+    if (hasJson) {
+      console.log(JSON.stringify({
+        error: err.code ?? "UNKNOWN_ERROR",
+        message: err.message,
+        details: err.details ?? {},
+        exitCode: err.exitCode ?? 1
+      }));
+    } else {
+      console.error(`Error: ${err.message}`);
+    }
+    await exitAfterFlush(err.exitCode ?? 1);
+  }
+}
 if (command === "publish") {
   const rootIdx = args.indexOf("--root");
   const rawRoot = rootIdx !== -1 && args[rootIdx + 1] ? args[rootIdx + 1] : process.cwd();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.5",
+  "version": "0.9.6",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/platform-manifest.json

@@ -2,11 +2,11 @@
   "schemaVersion": "1.0.0",
   "platformId": "release-skill",
   "platformName": "release-skill Plugin Platform",
-  "version": "0.9.5",
+  "version": "0.9.6",
   "logicalRoot": "skills-src/",
-  "logicalRootDigest": "3ead4305d76f86d100ca328e5051fceea9adc9fd308f2658b1bc24642b6af302",
-  "projectionDigest": "811660beafb951a5c2121128f3b142caf3dbe1fcf92a59183e6528983a5abfe8",
-  "projectionId": "release-skill:platform:0.9.5",
+  "logicalRootDigest": "4338c7c5a7efd38ca372049526e5bdd198087491f76702cd21d491741bfad835",
+  "projectionDigest": "c4d40afd481d78907d51ef9be1dc2238834d566b9a9792f1d25da19f57368d7d",
+  "projectionId": "release-skill:platform:0.9.6",
   "manifestRequired": true,
   "projectionSources": {
     "skills-src-root": {

package/skills/release-help/SKILL.md

@@ -12,7 +12,7 @@ description: "Discoverable entry point for release-skill: dependency and environ
 ## 职责
 
 - 依赖和环境检查：Node.js >= 22、Git 决定本地准备就绪度；npm/gh 另行决定生产依赖就绪度
-- 能力说明：缺少配置时走 `help → setup → assess`；已有配置的安全默认路径是 `help → assess → prepare --offline`；日常生产发布优先使用可恢复的 `ship`，兼容的分阶段闭环仍是 `prepare --online --production → approve → publish → verify`。冻结计划批准是正常发布级流程的唯一批准门；声明 `requiresApproval: true` 的 postPublish hook 仍须等待独立 checkpoint 批准。若计划声明 `postVerify` hook，本机收尾必须等待 `ship` 产出的完成 postVerify run，不能把仅有 `VERIFIED` 的 verify run 当作本机收尾授权。核心发布流程跨平台，WorkBuddy 本机收尾仅支持 macOS
+- 能力说明：缺少配置时走 `help → setup → assess`；已有配置的安全默认路径是 `help → assess → prepare --offline`；日常生产发布优先使用可恢复的 `ship`，兼容的分阶段闭环仍是 `prepare --online --production → approve → publish → verify`。冻结计划批准是正常发布级流程的唯一批准门；声明 `requiresApproval: true` 的 postPublish hook 仍须等待独立 checkpoint 批准。若计划声明 `postVerify` hook，可用 `postverify` 直接执行独立收尾 run，也可由 `ship` 编排该阶段；本机收尾必须等待完成的 postVerify run，不能把仅有 `VERIFIED` 的 verify run 当作本机收尾授权。核心发布流程跨平台，WorkBuddy 本机收尾仅支持 macOS
 - 最小示例：展示从 release-help 到 release-assess 的最短路径
 - 只读诊断：运行 dry-run 检查，不修改任何文件
 - 故障引导：根据错误码指向对应的修复 Skill
@@ -51,6 +51,10 @@ node "${CLAUDE_PLUGIN_ROOT}/bin/release-skill.mjs" ship --root <path> --target-v
 # 多发布单元项目显式选择本轮范围；未传 --unit 时仍为全部单元
 node "${CLAUDE_PLUGIN_ROOT}/bin/release-skill.mjs" ship --root <path> \
   --target-version <version> --unit <unit-a> --unit <unit-b> --json
+# 对已经 VERIFIED 的计划独立执行 postVerify hook；不读取或写入 ship state
+node "${CLAUDE_PLUGIN_ROOT}/bin/release-skill.mjs" postverify --root <path> \
+  --plan <plan-path> --approval <approval-path> --run <verified-run-path> \
+  --hook-approval <immutable-hook-approval-path> --json
 # 开发阶段执行声明 hooks 并生成 prepare 可复用的内容绑定收据
 # 配置时刻即授权（FM-16 处置 A）：hook 是任意本地进程、无隔离、触发前无确认点，
 # 命令调用本身即授权执行配置中的 hooks

package/skills/release-verify/SKILL.md

@@ -15,6 +15,11 @@ verify 是发布流程的最终验证阶段，是唯一能将状态提升到 `VE
 它执行远端状态重检、精确 npm 安装烟雾测试和消费者插件安装验证。
 verify 只接受 `PUBLISHED` 状态的源 run；`VERIFIED` 是终态，不会再次派生运行。
 
+计划声明 `postVerify` hook 时，`postverify` 命令负责执行独立的收尾阶段。它接收
+`VERIFIED` verify run、同一计划的 approval，以及逐个传入的 checkpoint approval，
+然后原样调用现有 `postVerifyRelease`。该命令产生独立的 `postverify` run，不读取或写入
+ship state；hook approval 缺失、错误或过期时，在 hook 执行前失败关闭。
+
 **注意**: distribute gate (W1) 已经实现并集成在标准 verify 流程中。verify 现在会检查 postPublish 分发状态（git mirror + marketplace index），只有当所有外部动作都完成并通过验证时才达到 VERIFIED。
 
 **工作流兼容性**: 
@@ -45,13 +50,17 @@ verify 只接受 `PUBLISHED` 状态的源 run；`VERIFIED` 是终态，不会再
 2. 使用插件根相对路径运行 CLI；命令调用本身即授权执行已配置的 verification gate 和 smoke process
 3. 检查 exit code 和结构化状态：`VERIFIED`（全部通过）/ 失败（具体错误）
 4. 只有 `VERIFIED` 才是发布 happy end
-5. 达到 `VERIFIED` 后先检查计划是否声明 `postVerify` hook：有未完成 hook 时，先按 approval 合同批准并通过 `ship` 完成 postVerify，再把最终 `DISTRIBUTED` postVerify run 路径交给 `release-finish`；没有 postVerify hook 时，才把当前 verify run 路径交给 `release-finish`。随后按清单主动询问分支合并和本机宿主插件更新；发布策略已包含分支动作时略过合并询问
+5. 达到 `VERIFIED` 后先检查计划是否声明 `postVerify` hook：直接收尾使用独立的 `postverify --plan --approval --run --hook-approval`，由该命令产生 `DISTRIBUTED` postVerify run；若仍由持久化 ship state 承担编排，则使用 `ship --hook-approval` 完成同一阶段，再把最终 run 路径交给 `release-finish`。没有 postVerify hook 时，把当前 verify run 路径交给 `release-finish`。随后按清单主动询问分支合并和本机宿主插件更新；发布策略已包含分支动作时略过合并询问
 
 ## 确定性脚本调用
 
 ```bash
 # 从插件根运行
 node "${CLAUDE_PLUGIN_ROOT}/bin/release-skill.mjs" verify --root <path> --plan <plan-path> --run <run-path> --json
+# 独立执行已 VERIFIED 计划的 postVerify hook；每个 requiresApproval hook 单独传入批准记录
+node "${CLAUDE_PLUGIN_ROOT}/bin/release-skill.mjs" postverify --root <path> \
+  --plan <plan-path> --approval <approval-path> --run <verified-run-path> \
+  --hook-approval <immutable-hook-approval-path> --json
 ```
 
 ## 验证步骤
@@ -63,6 +72,9 @@ node "${CLAUDE_PLUGIN_ROOT}/bin/release-skill.mjs" verify --root <path> --plan <
 5. 对 Claude/Codex marketplace distribution 执行全新隔离消费者安装验证；收集 Kimi/CodeBuddy 的非阻塞 `manualFollowUps`
 6. 全部通过 → `VERIFIED`
 
+`postverify` 不属于上述远端验证步骤。它只处理已经达到 `VERIFIED` 的计划，并把
+`postVerify` 阶段的执行结果写入独立 run。
+
 ## 发布后收尾
 
 `VERIFIED` 不代表要自动修改开发分支或本机宿主。进入 `release-finish` 后，只有用户明确同意，才执行对应的本地动作。本机插件更新失败不会改变发布终态。

package/skills-src/release-help/SKILL.md

@@ -12,7 +12,7 @@ description: "Discoverable entry point for release-skill: dependency and environ
 ## 职责
 
 - 依赖和环境检查：Node.js >= 22、Git 决定本地准备就绪度；npm/gh 另行决定生产依赖就绪度
-- 能力说明：缺少配置时走 `help → setup → assess`；已有配置的安全默认路径是 `help → assess → prepare --offline`；日常生产发布优先使用可恢复的 `ship`，兼容的分阶段闭环仍是 `prepare --online --production → approve → publish → verify`。冻结计划批准是正常发布级流程的唯一批准门；声明 `requiresApproval: true` 的 postPublish hook 仍须等待独立 checkpoint 批准。若计划声明 `postVerify` hook，本机收尾必须等待 `ship` 产出的完成 postVerify run，不能把仅有 `VERIFIED` 的 verify run 当作本机收尾授权。核心发布流程跨平台，WorkBuddy 本机收尾仅支持 macOS
+- 能力说明：缺少配置时走 `help → setup → assess`；已有配置的安全默认路径是 `help → assess → prepare --offline`；日常生产发布优先使用可恢复的 `ship`，兼容的分阶段闭环仍是 `prepare --online --production → approve → publish → verify`。冻结计划批准是正常发布级流程的唯一批准门；声明 `requiresApproval: true` 的 postPublish hook 仍须等待独立 checkpoint 批准。若计划声明 `postVerify` hook，可用 `postverify` 直接执行独立收尾 run，也可由 `ship` 编排该阶段；本机收尾必须等待完成的 postVerify run，不能把仅有 `VERIFIED` 的 verify run 当作本机收尾授权。核心发布流程跨平台，WorkBuddy 本机收尾仅支持 macOS
 - 最小示例：展示从 release-help 到 release-assess 的最短路径
 - 只读诊断：运行 dry-run 检查，不修改任何文件
 - 故障引导：根据错误码指向对应的修复 Skill
@@ -51,6 +51,10 @@ node "${CLAUDE_PLUGIN_ROOT}/bin/release-skill.mjs" ship --root <path> --target-v
 # 多发布单元项目显式选择本轮范围；未传 --unit 时仍为全部单元
 node "${CLAUDE_PLUGIN_ROOT}/bin/release-skill.mjs" ship --root <path> \
   --target-version <version> --unit <unit-a> --unit <unit-b> --json
+# 对已经 VERIFIED 的计划独立执行 postVerify hook；不读取或写入 ship state
+node "${CLAUDE_PLUGIN_ROOT}/bin/release-skill.mjs" postverify --root <path> \
+  --plan <plan-path> --approval <approval-path> --run <verified-run-path> \
+  --hook-approval <immutable-hook-approval-path> --json
 # 开发阶段执行声明 hooks 并生成 prepare 可复用的内容绑定收据
 # 配置时刻即授权（FM-16 处置 A）：hook 是任意本地进程、无隔离、触发前无确认点，
 # 命令调用本身即授权执行配置中的 hooks