release-skill 0.9.7 → 0.9.9

package/.agents/plugins/marketplace.json

@@ -18,6 +18,15 @@
       },
       "category": "DevOps",
       "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification"
+    },
+    {
+      "name": "foundation-adoption-review",
+      "source": {
+        "source": "url",
+        "url": "https://github.com/ifoohoo/foundation-adoption-review.git",
+        "ref": "refs/tags/foundation-adoption-review-v0.1.0",
+        "sha": "7e8032735f7589dbbeecc1012c8f6a1f32390ada"
+      }
     }
   ]
 }

package/.claude-plugin/marketplace.json

@@ -9,12 +9,22 @@
     {
       "name": "release-skill",
       "source": "./",
-      "version": "0.9.7",
+      "version": "0.9.9",
       "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
       "author": {
         "name": "广州市风荷科技有限公司"
       },
       "license": "Apache-2.0"
+    },
+    {
+      "name": "foundation-adoption-review",
+      "source": {
+        "source": "github",
+        "repo": "ifoohoo/foundation-adoption-review",
+        "ref": "foundation-adoption-review-v0.1.0",
+        "sha": "7e8032735f7589dbbeecc1012c8f6a1f32390ada"
+      },
+      "version": "0.1.0"
     }
   ]
 }

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.7",
+  "version": "0.9.9",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codebuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.7",
+  "version": "0.9.9",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.7",
+  "version": "0.9.9",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"
@@ -19,7 +19,7 @@
     ],
     "defaultPrompt": [
       "Assess this project for release readiness.",
-      "Prepare a release plan for version 0.9.7.",
+      "Prepare a release plan for version 0.9.9.",
       "Help me understand the release workflow."
     ]
   }

package/.kimi-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.7",
+  "version": "0.9.9",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/CHANGELOG.md

@@ -1,5 +1,57 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.9.9 locale=en baseline=sha256:44d7cba7d5e4cbe182157c8b200e3a2d9b494d61a9555cd5af5c62c97a60fb37 -->
+## [0.9.9] - 2026-09-04
+
+0.9.9 is a local source candidate that makes Kimi Code plugin trust compare the complete displayed installation identity with the frozen URL. It consumes the three Foundation packages at the exact 0.16.0 release. This note is not evidence of publication, real-host acceptance, consumer installation verification, or independent acceptance.
+
+### Security
+
+- Kimi Code extracts the complete installation identity from the plugin trust dialog, removes ANSI/OSC control sequences and soft wrapping, and compares the result exactly with the frozen installation URL. Similar repository names and tag prefixes or suffixes fail closed.
+- Claude and Codex continue to verify the frozen marketplace repository, ref, and commit before the first marketplace or plugin write when a rebind is required. An unreachable remote, missing ref, or commit mismatch returns `MANUAL_REQUIRED` for that host with zero host writes; other selected hosts continue.
+- Kimi Code continues only when the selected row is confirmed as `Trust and install`. A `Trust this folder?` dialog, an unknown screen, timeout, EOF, or mismatched identity fails closed before unintended confirmation.
+- Any host plan remains a qualified frozen-plan path and requires a VERIFIED-run from the same release lineage before host acceptance; this source candidate does not provide that acceptance.
+
+### Changed
+
+- The English and Chinese README scope descriptions identify 0.9.9 as the current source candidate.
+- The public release-finish flow continues to treat a `proposal-inbox` postVerify hook as proposal delivery plus delivery evidence. The receiver applies, renders, and synchronizes the proposal under its own runbook and governance; no Hub repository or push sequence is built into the public Skill.
+- Kimi Code continues to resolve its effective configuration root from explicit `kimiHome`, then `KIMI_CODE_HOME`, then `~/.kimi-code`; the TUI process and post-install observation use the same root.
+- The current 0.9.9 candidate keeps the narrow R-05 Hook cache v2 consumer path, keeps the CodeBuddy plugin entry explicit as `marketplace: release-skill`, and keeps `--root <project-root>` in release-finish local-finish examples. Foundation dependencies remain pinned to the three released 0.16.0 packages.
+
+### Upgrade Notes
+
+Prepare and approve a new 0.9.9 production plan for these changes. After verify reaches `VERIFIED`, complete every declared postVerify hook with its own immutable checkpoint approval before running release-finish. Real-host acceptance can begin only after 0.9.9 is officially published and VERIFIED; the official 0.9.9 entry must be installed or reloaded first. A source candidate, an older installed entry, or the mere existence of plan and run files cannot complete real-host acceptance. Each selected host must complete a first successful update. On the second run, Claude, Kimi, CodeBuddy, and WorkBuddy must report `ALREADY_CURRENT`; Codex may report `UPDATED` only when it reinstalls the same exact 0.9.9 frozen reference, payload validation passes, and `restartRequired=true` is declared. The local updater uses the Kimi Code TUI path verified for 0.40.1; it does not switch to a web or REST installation path. Confirm that the complete frozen installation URL shown by the plugin trust dialog is exact, and never approve a folder-trust dialog as part of plugin installation. This candidate does not claim that 0.9.9 has already been published or VERIFIED.
+<!-- release-skill:changelog:end version=0.9.9 locale=en -->
+
+
+<!-- release-skill:changelog:start version=0.9.8 locale=en baseline=sha256:ed56048811dd7946bfdaa4022d0430906db713ef86eed1528395dbfb031b075e -->
+## [0.9.8] - 2026-09-04
+
+0.9.8 is a local source candidate that makes release-finish safe across receiver boundaries and current local hosts. It removes Hub-specific work from the public finishing flow, verifies frozen Claude and Codex marketplace identities before rebind writes, supports the Kimi Code 0.40.1 TUI, and skips empty distribute runs for plans that contain only postVerify hooks. It consumes the three Foundation packages at the exact 0.16.0 release. This note is not evidence of publication, real-host acceptance, consumer installation verification, or independent acceptance.
+
+### Security
+
+- Claude and Codex verify the frozen marketplace repository, ref, and commit before the first marketplace or plugin write when a rebind is required. An unreachable remote, missing ref, or commit mismatch returns `MANUAL_REQUIRED` for that host with zero host writes; other selected hosts continue.
+- Kimi Code plugin trust proceeds only when the dialog contains the frozen repository and tag and the selected row is confirmed as `Trust and install`. A `Trust this folder?` dialog, an unknown screen, timeout, EOF, or mismatched identity fails closed before unintended confirmation.
+- Kimi Code reports success only after the TUI displays its install-finished result and the installed registry, package version, tag, revision, managed root, and payload all match the frozen plan.
+- Any host plan remains a qualified frozen-plan path and requires a VERIFIED-run from the same release lineage before host acceptance; this source candidate does not provide that acceptance.
+
+### Changed
+
+- The public release-finish flow treats a `proposal-inbox` postVerify hook as proposal delivery plus delivery evidence. The receiver applies, renders, and synchronizes the proposal under its own runbook and governance; no Hub repository or push sequence is built into the public Skill.
+- Local-host ordering follows each host's frozen installation source. Receiver completion is not a universal prerequisite for updating unrelated hosts.
+- Kimi Code resolves its effective configuration root from explicit `kimiHome`, then `KIMI_CODE_HOME`, then `~/.kimi-code`; the TUI process and post-install observation use the same root.
+- The Kimi Code 0.40.1 TUI path normalizes ANSI/OSC control sequences and soft-wrapped URLs, uses a wide pseudo-terminal, submits commands through bracketed paste plus CSI Enter, and waits for explicit prompt, trust, install-result, reload, and exit states.
+- A single phase-aware postPublish predicate now requires distribute only for targets, explicit distribute hooks, or hooks whose omitted phase defaults to distribute. A plan containing only postVerify hooks moves from PUBLISHED directly to verify and runs postVerify independently after VERIFIED.
+- The current 0.9.8 candidate includes the narrow R-05 Hook cache v2 consumer path, keeps the CodeBuddy plugin entry explicit as `marketplace: release-skill`, and keeps `--root <project-root>` in release-finish local-finish examples. Foundation dependencies are pinned to the three released 0.16.0 packages.
+
+### Upgrade Notes
+
+Prepare and approve a new 0.9.8 production plan for these changes. After verify reaches `VERIFIED`, complete every declared postVerify hook with its own immutable checkpoint approval before running release-finish. Real-host acceptance can begin only after 0.9.8 is officially published and VERIFIED; the official 0.9.8 entry must be installed or reloaded first. A source candidate, an older installed entry, or the mere existence of plan and run files cannot complete real-host acceptance. Each selected host must complete a first successful update. On the second run, Claude, Kimi, CodeBuddy, and WorkBuddy must report `ALREADY_CURRENT`; Codex may report `UPDATED` only when it reinstalls the same exact 0.9.8 frozen reference, payload validation passes, and `restartRequired=true` is declared. The local updater uses the Kimi Code TUI path verified for 0.40.1; it does not switch to a web or REST installation path. Confirm the frozen repository and tag shown by the plugin trust dialog, and never approve a folder-trust dialog as part of plugin installation. This candidate does not claim that 0.9.8 has already been published or VERIFIED.
+<!-- release-skill:changelog:end version=0.9.8 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.9.7 locale=en baseline=sha256:6e411cb3026241b30954e2f23e0eadc8674b3531927e8c5069c92b46749fdb01 -->
 ## [0.9.7] - 2026-09-02
 

package/INSTALL.md

@@ -2,7 +2,7 @@
 
 [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.9.7 -->
+<!-- release-skill:release-version: 0.9.9 -->
 ## Prerequisites
 
 - Node.js 22.0.0 or later
@@ -41,7 +41,7 @@ Claude Code, CodeBuddy, WorkBuddy, and Codex install release-skill from the
 bundled-family marketplace [ifoohoo/release-skill](https://github.com/ifoohoo/release-skill).
 The plugin repository itself carries the marketplace manifest
 (`.claude-plugin/marketplace.json`), so no external marketplace is required.
-Kimi Code has no marketplace install API — see the
+release-skill currently invokes no scriptable install API for Kimi Code — see the
 [Kimi Code section](#install-as-a-kimi-code-plugin). Add the marketplace once,
 then install the plugin:
 
@@ -78,9 +78,9 @@ Then install `release-skill` from the interactive `/plugins` browser.
 
 **Kimi Code** (interactive session):
 
-Kimi Code has no marketplace install API. Installation is a post-release manual
-task pinned to a specific release tag. release-skill reports the task but does
-not verify its completion.
+release-skill currently uses the version-pinned interactive TUI path for Kimi
+Code. The release state machine reports installation as a post-release manual
+task and does not verify its completion.
 
 ### Alternative: direct repository install (advanced)
 
@@ -103,8 +103,8 @@ Kimi Code plugin manifest lives at `.kimi-plugin/plugin.json`, mirroring
 `.claude-plugin/plugin.json` and `.codex-plugin/plugin.json`, and the package
 ships `adapters/kimi/` next to `adapters/claude/` and `adapters/codex/`.
 
-Kimi Code has an interactive plugin marketplace but **no scriptable,
-non-interactive install API**. For new release plans, `publish` completes the
+release-skill currently uses and verifies only Kimi Code's interactive TUI path;
+it invokes **no scriptable, non-interactive install API**. For new release plans, `publish` completes the
 automated remote writes and returns a non-blocking `manualFollowUps` entry with
 the pinned install URL. `verify` does not install or inspect Kimi and reports
 `verifiedBySystem: false`; the task does not block `VERIFIED`.
@@ -114,7 +114,7 @@ tag pinned to the exact version (never the bare repository URL, which installs
 the latest release or default branch), confirm the trust prompt, then reload:
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.7
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.9
    /plugins reload
    ```
 
@@ -129,7 +129,15 @@ installation or migration, release-finish re-reads Kimi's managed installation r
 rather than reusing the pre-operation observation, then verifies the final identity
 and actual payload. If the existing entry is a legacy local-path
 install, release-finish removes it and installs the pinned release tag in the
-same TUI session before accepting the trust prompt and reloading. This local
+same TUI session before accepting the plugin trust prompt and reloading.
+
+The effective configuration root is explicit `kimiHome`, then
+`KIMI_CODE_HOME`, then `~/.kimi-code`. The TUI process and post-operation
+observation use that same root. release-finish strips ANSI/OSC control sequences
+and soft wrapping before it checks the frozen repository, tag, and selected
+`Trust and install` action inside the plugin trust dialog. A `Trust this folder?`
+prompt, unknown interface, timeout, early exit, or identity mismatch stops the
+flow without confirming folder trust or continuing installation. This local
 check is not part of `verify` and does not alter the `VERIFIED` release state.
 
 No receipt or attestation is required. The `attest` command remains available

package/INSTALL.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.9.7 -->
+<!-- release-skill:release-version: 0.9.9 -->
 ## 前置条件
 
 - Node.js 22.0.0 或更高版本
@@ -37,8 +37,8 @@ release-skill help
 Claude Code、CodeBuddy、WorkBuddy 和 Codex 从 bundled-family 市场
 [ifoohoo/release-skill](https://github.com/ifoohoo/release-skill)
 安装 release-skill。插件仓库自身携带市场清单
-（`.claude-plugin/marketplace.json`），无需外部市场。Kimi Code 没有市场安装
-接口——见 [Kimi Code 小节](#安装为-kimi-code-插件)。先添加一次市场，再安装
+（`.claude-plugin/marketplace.json`），无需外部市场。release-skill 当前没有接入
+Kimi Code 的可脚本化安装接口，见 [Kimi Code 小节](#安装为-kimi-code-插件)。先添加一次市场，再安装
 插件：
 
 > **前置条件：GitHub 访问。** `owner/repo` 简写会让 Claude Code 通过
@@ -73,8 +73,8 @@ codex plugin marketplace add ifoohoo/release-skill
 
 **Kimi Code**（交互会话中）：
 
-Kimi Code 没有市场安装接口，发布后需手动安装并钉死到特定 release tag。
-release-skill 会返回待办，但不核验其完成结果。
+release-skill 当前对 Kimi Code 采用钉死版本的交互式 TUI 路径。发布状态机会把安装
+列为发布后人工待办，不核验其完成结果。
 
 ### 备选：直接从仓库安装（进阶）
 
@@ -95,8 +95,8 @@ Kimi Code 是与 Claude Code 和 Codex 并列的受支持插件宿主。Kimi Cod
 `.codex-plugin/plugin.json` 对应；包内同时提供 `adapters/kimi/`，与
 `adapters/claude/`、`adapters/codex/` 并列。
 
-Kimi Code 有交互式插件市场，但**没有可脚本化的非交互安装接口**。因此
-新发布计划中，`publish` 完成自动化远端写入后返回非阻塞的
+release-skill 当前只采用并验证 Kimi Code 的交互式 TUI 路径，**无可脚本化安装接口
+接入**。因此新发布计划中，`publish` 完成自动化远端写入后返回非阻塞的
 `manualFollowUps`，其中含钉死的安装 URL；`verify` 不安装也不检查 Kimi，返回
 `verifiedBySystem: false`，该待办不阻塞 `VERIFIED`。
 
@@ -104,7 +104,7 @@ Kimi Code 有交互式插件市场，但**没有可脚本化的非交互安装
 （切勿使用裸仓库地址，它会安装最新 release 或默认分支），确认信任提示后重新加载：
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.7
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.9
    /plugins reload
    ```
 
@@ -114,7 +114,13 @@ Kimi Code 有交互式插件市场，但**没有可脚本化的非交互安装
 完成后核对结果。`.git` 目录只提供附加诊断，不是通过条件。发生安装或迁移后，
 release-finish 会重新读取 Kimi 的受管安装根，不复用操作前的观察；随后核对最终身份与
 真实载荷。若现有条目来自旧的本地路径安装，release-finish 会在同一个 TUI 会话中先
-移除，再按发布标签安装、确认信任并重新加载。这个本机检查不属于 `verify`，也不会改变
+移除，再按发布标签安装、确认插件信任并重新加载。
+
+有效配置根依次取显式 `kimiHome`、`KIMI_CODE_HOME`、`~/.kimi-code`，TUI 进程和
+操作后观察使用同一根。release-finish 会先清理 ANSI/OSC 控制序列和软换行，再在插件
+信任对话框内核对冻结仓库、标签和当前选中的 `Trust and install`。出现
+`Trust this folder?`、未知界面、超时、提前退出或身份不一致时，流程停止，不确认目录
+信任，也不继续安装。这个本机检查不属于 `verify`，也不会改变
 已经完成的 `VERIFIED` 发布状态。
 
 新计划无需收据或人工证明。`attest` 命令仅兼容缺少

package/README.md

@@ -2,7 +2,7 @@
 
 [简体中文](README.zh-CN.md) · Installation: [English](INSTALL.md) / [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.9.7 -->
+<!-- release-skill:release-version: 0.9.9 -->
 Release preparation for Claude Code, CodeBuddy, WorkBuddy, Codex, and Kimi Code, with human-edited files kept intact.
 
 release-skill helps a maintainer answer three questions: what will be released,
@@ -14,34 +14,31 @@ Setup surfaces only the deterministic `compactSummary` review view; the full
 report stays in a temporary session directory.
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.9.7** (2026-09-02)
+**0.9.9** (2026-09-04)
 
-0.9.7 is a local source candidate that retains the 0.9.6 postverify and isolated install-tree safeguards and corrects verify's bundled-family install-root coordinate: when an adapter `installPath` is already the installed plugin root, manifest `skills` are interpreted relative to `.`. It consumes the three Foundation packages at the exact 0.16.0 release. This note is not evidence of publication, real-host acceptance, consumer installation verification, or independent acceptance.
+0.9.9 is a local source candidate that makes Kimi Code plugin trust compare the complete displayed installation identity with the frozen URL. It consumes the three Foundation packages at the exact 0.16.0 release. This note is not evidence of publication, real-host acceptance, consumer installation verification, or independent acceptance.
 
 **Security**
 
-- `postverify` binds `planDigest`, the source `VERIFIED` run, each `hookId`, and its immutable hook approval; expired or mismatched approvals fail closed before hook execution, without adding a second state or authority.
-- Declared payload symlinks, frozen-source symlinks, and legacy install-tree symlinks continue to fail closed; host-added symlinks are recorded as raw targets only.
-- Missing paths, files, and symlinks continue to fail closed.
+- Kimi Code extracts the complete installation identity from the plugin trust dialog, removes ANSI/OSC control sequences and soft wrapping, and compares the result exactly with the frozen installation URL. Similar repository names and tag prefixes or suffixes fail closed.
+- Claude and Codex continue to verify the frozen marketplace repository, ref, and commit before the first marketplace or plugin write when a rebind is required. An unreachable remote, missing ref, or commit mismatch returns `MANUAL_REQUIRED` for that host with zero host writes; other selected hosts continue.
+- Kimi Code continues only when the selected row is confirmed as `Trust and install`. A `Trust this folder?` dialog, an unknown screen, timeout, EOF, or mismatched identity fails closed before unintended confirmation.
 - Any host plan remains a qualified frozen-plan path and requires a VERIFIED-run from the same release lineage before host acceptance; this source candidate does not provide that acceptance.
 
 **Changed**
 
-- When an adapter `installPath` is already the installed plugin root, verify interprets the manifest's `skills` path relative to `.`. prepare and publish keep their frozen-snapshot coordinates unchanged.
-- Allow multiple frozen host manifests to share one non-empty canonical source Skill surface; closure scans that surface once while host coverage retains every declared host.
-- Before any external write, publish re-derives the frozen manifest claims and rechecks the closure.
-- Consumer install paths remain isolated by host realpath; overlapping realpaths fail closed.
-- Retain the public `postverify` path and the stable isolated install-tree record path; this candidate does not expand standalone-index or host acceptance support.
-- Use Foundation 0.16.0 `createFilesystemRootBinding` and `observeFilesystemTree` in record mode for Claude and Codex marketplace install-tree observation; ordinary files keep the existing comparison, directories stay out of extra installed paths, and the frozen `manifestDigest` remains unchanged.
-- Keep the narrow R-05 Hook cache v2 consumer path, the explicit CodeBuddy plugin entry (`marketplace: release-skill`), and `--root <project-root>` in release-finish local-finish examples.
+- The English and Chinese README scope descriptions identify 0.9.9 as the current source candidate.
+- The public release-finish flow continues to treat a `proposal-inbox` postVerify hook as proposal delivery plus delivery evidence. The receiver applies, renders, and synchronizes the proposal under its own runbook and governance; no Hub repository or push sequence is built into the public Skill.
+- Kimi Code continues to resolve its effective configuration root from explicit `kimiHome`, then `KIMI_CODE_HOME`, then `~/.kimi-code`; the TUI process and post-install observation use the same root.
+- The current 0.9.9 candidate keeps the narrow R-05 Hook cache v2 consumer path, keeps the CodeBuddy plugin entry explicit as `marketplace: release-skill`, and keeps `--root <project-root>` in release-finish local-finish examples. Foundation dependencies remain pinned to the three released 0.16.0 packages.
 
 **Upgrade Notes**
 
-Prepare a new 0.9.7 plan when adopting this candidate. The `postverify` command requires the same plan digest, a source `VERIFIED` run, and an immutable approval for each declared hook; an expired or mismatched approval stops before hook execution. Real-host acceptance can begin only after 0.9.7 is officially published and VERIFIED; the official 0.9.7 entry must be installed or reloaded first. A source candidate, an older installed entry, or the mere existence of plan and run files cannot complete real-host acceptance. Each selected host must complete a first successful update. On the second run, Claude, Kimi, CodeBuddy, and WorkBuddy must report `ALREADY_CURRENT`; Codex may report `UPDATED` only when it reinstalls the same exact 0.9.7 frozen reference, payload validation passes, and `restartRequired=true` is declared. Before the official 0.9.7 release and VERIFIED result, do not claim that GLAF4 passed. After the official 0.9.7 release, the original GLAF4 0.5.4 immutable plan and PUBLISHED run can be reverified; GLAF4 does not need to be reissued. This source candidate does not claim publication, GLAF4 acceptance, or consumer-installation verification.
+Prepare and approve a new 0.9.9 production plan for these changes. After verify reaches `VERIFIED`, complete every declared postVerify hook with its own immutable checkpoint approval before running release-finish. Real-host acceptance can begin only after 0.9.9 is officially published and VERIFIED; the official 0.9.9 entry must be installed or reloaded first. A source candidate, an older installed entry, or the mere existence of plan and run files cannot complete real-host acceptance. Each selected host must complete a first successful update. On the second run, Claude, Kimi, CodeBuddy, and WorkBuddy must report `ALREADY_CURRENT`; Codex may report `UPDATED` only when it reinstalls the same exact 0.9.9 frozen reference, payload validation passes, and `restartRequired=true` is declared. The local updater uses the Kimi Code TUI path verified for 0.40.1; it does not switch to a web or REST installation path. Confirm that the complete frozen installation URL shown by the plugin trust dialog is exact, and never approve a folder-trust dialog as part of plugin installation. This candidate does not claim that 0.9.9 has already been published or VERIFIED.
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **Current boundary:** v0.9.7 is the current source candidate. This README
+> **Current boundary:** v0.9.9 is the current source candidate. This README
 > records intended scope and verification boundaries; it is not evidence of
 > publication, consumer-installation verification, or independent acceptance.
 > Release availability must be established from the corresponding release records
@@ -65,7 +62,7 @@ Prepare a new 0.9.7 plan when adopting this candidate. The `postverify` command
 > publish global preflight.
 
 <!-- release-skill:capability:safe-first-command -->
-> **Production path verified since the v0.1.1 milestone; v0.9.7 is the current
+> **Production path verified since the v0.1.1 milestone; v0.9.9 is the current
 > source candidate. Its README does not establish publication,
 > consumer-installation verification, or independent acceptance.**
 > The npm-installed CLI is the supported user entry. Source checkout
@@ -94,7 +91,7 @@ checkpoints remain intact and use matching-version recovery. Evidence v1 stays
 read-only; v2 uses a closed top level with phase extensions in `details`.
 Summaries and recovery suggestions are diagnostic, never publication authority.
 
-The current 0.9.7 candidate includes the narrow R-05 Hook cache v2 consumer
+The current 0.9.9 candidate includes the narrow R-05 Hook cache v2 consumer
 path, the public `postverify` path, and the stable isolated install-tree record
 path (A2/A3). It still
 excludes R-02 safe full-tree inventory, R-10 historical-release verification
@@ -142,13 +139,11 @@ This scope summary is not a remote publication record or a consumer upgrade inst
 > `proposal-inbox`, `marketplace-registry-entry`, `docs-refresh`, and
 > `notify-handoff` (declared in `hooks` form). `proposal-inbox` delivers a
 > machine-readable update proposal through a git-push or local-file transport
-> for autonomous downstream consumption; without a target it degrades to
+> and records the delivery result. The receiver applies, renders, and publicly
+> synchronizes the proposal under the receiver's own runbook and governance;
+> delivery does not prove those receiver-side steps. Without a target it degrades to
 > `notify-handoff` behavior instead of failing. `notify-handoff` is the
 > zero-write floor: it only renders a deterministic manual sync checklist.
-> release-skill dogfoods this capability: this repository's own project
-> configuration declares a `proposal-inbox` (git-push) hub-entry proposal
-> toward the public `skill-family-hub` repository, to be delivered during the
-> v0.7.0 release in the postVerify phase under its own checkpoint approval.
 <!-- release-skill:capability:postpublish-presets -->
 
 <!-- release-skill:capability:postverify-stage -->
@@ -255,8 +250,9 @@ marketplace `ifoohoo/release-skill`:
 > `/plugin marketplace add https://github.com/ifoohoo/release-skill` — or set
 > `CLAUDE_CODE_PLUGIN_PREFER_HTTPS=1`.
 
-**Kimi Code:** Kimi Code has no marketplace install API. Install manually from a
-pinned release tag — see [INSTALL.md](INSTALL.md#install-as-a-kimi-code-plugin).
+**Kimi Code:** release-skill currently invokes no scriptable install API for
+Kimi Code. It uses the version-pinned interactive TUI path described in
+[INSTALL.md](INSTALL.md#install-as-a-kimi-code-plugin).
 
 See [INSTALL.md](INSTALL.md) for CodeBuddy, Codex, and Kimi Code commands.
 
@@ -754,7 +750,7 @@ closures. A release unit declares what reaches users via `distributions`:
 | `npm` | npm package with CLI entry | `npm install -g release-skill` |
 | `claude-plugin` | self-contained closure under `adapters/claude/` | automated marketplace checkpoint |
 | `codex-plugin` | self-contained closure under `adapters/codex/` | automated marketplace checkpoint |
-| `kimi-plugin` | self-contained closure (no scriptable install API) | non-blocking post-release manual task |
+| `kimi-plugin` | self-contained closure (release-skill invokes no scriptable install API) | non-blocking post-release manual task |
 | `codebuddy-plugin` | generated `adapters/workbuddy/` with `.codebuddy-plugin/plugin.json` | non-blocking post-release manual task |
 
 Each adapter closure bundles its own CLI, skills, and schemas for zero external
@@ -765,11 +761,18 @@ verification is automated. Kimi Code and CodeBuddy/WorkBuddy are returned as
 condition for the automated release to reach `VERIFIED`.
 
 After `VERIFIED`, the optional `release-finish` workflow can update Claude and
-Codex from the frozen marketplace identity, migrate or update Kimi through one
-controlled TUI session and verify its real managed payload, or update an existing
+Codex from the frozen marketplace identity. When either marketplace needs
+rebinding, a read-only remote check must prove the frozen repository, ref, and
+commit before that host's first write; a failed check leaves that host unchanged
+without stopping other selected hosts. The workflow can also migrate or update
+Kimi through one controlled TUI session and verify its real managed payload, or update an existing
 bundled-family CodeBuddy/WorkBuddy entry when the frozen tag and mutable branch
 both resolve to the frozen commit. It requires explicit user confirmation and
-does not change release status. Missing, standalone, inaccessible, or ambiguous
+does not change release status. Kimi uses one effective configuration root:
+explicit `kimiHome`, then `KIMI_CODE_HOME`, then `~/.kimi-code`. The TUI and
+post-operation observation share that root. A `Trust this folder?` prompt,
+unknown interface, timeout, early exit, or unprovable plugin identity returns a
+manual or failed result without confirming folder trust. Missing, standalone, inaccessible, or ambiguous
 CodeBuddy/WorkBuddy targets remain manual and receive no host mutation.
 WorkBuddy local updates are macOS-only; on other platforms they are skipped as
 unsupported. When a plan declares postVerify hooks, release-finish must receive

package/README.zh-CN.md

@@ -2,40 +2,37 @@
 
 [English](README.md) · 安装指南：[中文](INSTALL.zh-CN.md) / [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.9.7 -->
+<!-- release-skill:release-version: 0.9.9 -->
 面向 Claude Code、CodeBuddy、WorkBuddy、Codex 和 Kimi Code 的发布准备工具，完整保留人工维护的文件内容。
 
 release-skill 帮助维护者回答三个问题：准备发布什么、还有哪些检查未通过、最终发布的内容是什么。它不重新生成、也不回写项目源文件。`prepare` 把每个配置的公开文件复制到隔离快照并验证字节——先冻结并供人工审阅，再从同一份冻结产物发布。`setup` 只显示确定性的 `compactSummary` 审阅视图，完整报告保留在临时会话目录中。
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.9.7** (2026-09-02)
+**0.9.9** (2026-09-04)
 
-0.9.7 是保留 0.9.6 postverify 和隔离安装树安全边界、并修正 verify 的 bundled-family 安装根坐标的本地源码候选：当适配器的 `installPath` 已经是安装后的插件根目录时，manifest 的 `skills` 路径按 `.` 解释。三项 Foundation 依赖均精确消费已发布的 0.16.0。本说明不代表已经发布、完成真实宿主验收、完成消费者安装验证或通过独立验收。
+0.9.9 是修正 Kimi Code 插件信任身份精确比较的本地源码候选。三项 Foundation 依赖均精确消费已发布的 0.16.0。本说明不代表已经发布、完成真实宿主验收、完成消费者安装验证或通过独立验收。
 
 **安全**
 
-- `postverify` 绑定 `planDigest`、源 `VERIFIED` run、每个 `hookId` 和对应的不可变 hook approval；批准过期或不匹配时，在执行 hook 前失败关闭，不增加第二状态或第二权威。
-- 声明载荷 symlink、冻结源码 symlink 和 legacy 安装树 symlink 继续失败关闭；宿主新增 symlink 只记录原始目标。
-- 缺失路径、文件和 symlink 继续失败关闭。
+- Kimi Code 会从插件信任对话框提取完整安装身份，清除 ANSI/OSC 控制序列并归一软换行，再与冻结安装 URL 精确比较。相似仓库名、tag 前缀或 tag 后缀均失败关闭。
+- Claude 和 Codex 继续在确实需要重绑时，于第一条市场或插件写命令前验证冻结的 marketplace 仓库、ref 和 commit。远端不可达、ref 缺失或 commit 不一致时，该宿主以零写入返回 `MANUAL_REQUIRED`，其他已选宿主继续。
+- Kimi Code 只有在选中项确认为 `Trust and install` 时才继续。出现 `Trust this folder?`、未知界面、超时、EOF 或身份不一致时，在意外确认前失败关闭。
 - 任何宿主计划都必须是合格冻结计划，并要求同一发布谱系的 VERIFIED run 才能开始宿主验收；本源码候选不提供该验收。
 
 **变更**
 
-- 当适配器的 `installPath` 已经是安装后的插件根目录时，verify 按 `.` 解释 manifest 的 `skills` 路径；prepare 和 publish 的冻结快照坐标保持不变。
-- 允许多份冻结 host manifest 共享同一个非空 canonical source Skill surface；closure 只扫描一次，host coverage 保留每个已声明宿主。
-- publish 在任何外部写入前按冻结 manifest 事实重新派生 claims 并重检 closure。
-- 消费者安装路径继续按宿主 realpath 隔离；realpath 重合时失败关闭。
-- 保留公开 `postverify` 路径和稳定的隔离安装树记录路径；本候选不扩展 standalone-index 或宿主验收支持。
-- Claude 和 Codex 市场安装树继续使用 Foundation 0.16.0 的 `createFilesystemRootBinding` 与 record 模式 `observeFilesystemTree`；普通文件继续使用现有比较，目录不进入额外安装路径，冻结的 `manifestDigest` 保持不变。
-- 保留窄范围的 R-05 Hook cache v2 消费路径、CodeBuddy 插件显式的 `marketplace: release-skill` 条目，以及 release-finish 本机收尾示例中的 `--root <project-root>`。
+- 中英文 README 的范围说明统一把 0.9.9 标为当前源码候选。
+- 公共 release-finish 继续只把 `proposal-inbox` postVerify hook 定义为提案送达和送达证据。接收端按自身 runbook 和治理应用、渲染与同步提案；公共 Skill 不内置 Hub 仓库或推送顺序。
+- Kimi Code 有效配置根继续依次取显式 `kimiHome`、`KIMI_CODE_HOME` 和 `~/.kimi-code`；TUI 进程与安装后观察使用同一根目录。
+- 当前 0.9.9 候选保留窄范围的 R-05 Hook cache v2 消费路径，保留 CodeBuddy 插件显式的 `marketplace: release-skill` 条目，并在 release-finish 本机收尾示例中保留 `--root <project-root>`。Foundation 三包继续精确依赖已发布的 0.16.0。
 
 **升级说明**
 
-采用本候选时请重新准备 0.9.7 计划。`postverify` 要求同一计划摘要、源 `VERIFIED` run，以及每个已声明 hook 的不可变 approval；批准过期或不匹配时会在执行 hook 前停止。真实宿主验收只有在 0.9.7 正式发布并达到 VERIFIED 后才能开始；必须先安装或重载正式的 0.9.7 入口。源码候选、旧的已安装入口，或仅存在计划和运行文件，都不能完成真实宿主验收。每个选定宿主都必须先完成首次成功更新。第二次运行时，Claude、Kimi、CodeBuddy 和 WorkBuddy 必须返回 `ALREADY_CURRENT`；Codex 可以使用 `UPDATED`，但只有在重新安装同一精确 0.9.7 冻结引用、载荷验证通过并声明 `restartRequired=true` 时才允许这样返回。在 0.9.7 正式发布并达到 VERIFIED 前，不宣称 GLAF4 已通过。0.9.7 正式发布后，可以复验原 GLAF4 0.5.4 不可变计划和 PUBLISHED run；无需重新发布 GLAF4。本源码候选不代表已经发布、完成 GLAF4 验收或完成消费者安装验证。
+采用这些修复时，应准备并批准新的 0.9.9 production plan。verify 达到 `VERIFIED` 后，先用各 hook 独立的不可变 checkpoint approval 完成所有已声明 postVerify，再运行 release-finish。真实宿主验收只有在 0.9.9 正式发布并达到 VERIFIED 后才能开始；必须先安装或重载正式的 0.9.9 入口。源码候选、旧的已安装入口，或仅存在计划和运行文件，都不能完成真实宿主验收。每个已选宿主都必须完成首次成功更新。第二次运行时，Claude、Kimi、CodeBuddy 和 WorkBuddy 必须返回 `ALREADY_CURRENT`；Codex 可以返回 `UPDATED`，但只有在重新安装同一精确 0.9.9 冻结引用、载荷验证通过并声明 `restartRequired=true` 时才允许这样返回。本机 updater 采用已针对 Kimi Code 0.40.1 验证的 TUI 路径，不切换到 Web 或 REST 安装路径。插件信任界面显示的完整冻结安装 URL 必须精确一致；插件安装过程中不得批准目录信任界面。本候选不宣称 0.9.9 已经发布或达到 VERIFIED。
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **当前边界：** v0.9.7 只是当前源码候选。本 README 记录预期范围与验证边界，
+> **当前边界：** v0.9.9 只是当前源码候选。本 README 记录预期范围与验证边界，
 > 不代表已经发布、完成消费者安装验证或通过独立验收。
 > 版本可用性以对应发布记录及发布后验证结果为准。
 > v0.4.1 是更早的已发布里程碑（v0.2.2 曾处于已发布状态，后因平台验证收敛修复而更新）。
@@ -51,7 +48,7 @@ release-skill 帮助维护者回答三个问题：准备发布什么、还有哪
 > 远端唯一性检查在 `publish` 全局预检执行。
 
 <!-- release-skill:capability:safe-first-command -->
-> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.9.7 是当前源码候选，本 README 不证明该候选已经发布、完成消费者安装验证或通过独立验收。**
+> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.9.9 是当前源码候选，本 README 不证明该候选已经发布、完成消费者安装验证或通过独立验收。**
 > npm 安装的 CLI 是受支持的用户入口；源码 checkout 保留为开发/贡献者路径。
 >
 > **第一条命令：**
@@ -69,7 +66,7 @@ marketplace 委托目标工作区发布的边界不变。
 
 旧 production 计划缺少 `sourceAuthority` 时，在外部写入前拒绝。未发生外部写入的计划必须重新 prepare 并批准新摘要，不能补写旧计划或迁移批准。已有 `PARTIAL` 保留检查点，走匹配版本的恢复路径。evidence v1 只读；v2 顶层封闭，阶段扩展放在 `details`。摘要和恢复建议只作诊断，不构成发布权威。
 
-当前 0.9.7 候选包含窄范围的 R-05 Hook cache v2 消费路径、公开 `postverify` 路径和稳定隔离安装树记录路径（A2/A3）。当前仍不包含 R-02 安全整树盘点、R-10 历史发布验证的产品实现、真实 Kimi/WorkBuddy 公开市场安装与调用门禁或 Audit 公开离线发布记录验证器。本范围说明不构成远端发布记录或消费者升级指引。
+当前 0.9.9 候选包含窄范围的 R-05 Hook cache v2 消费路径、公开 `postverify` 路径和稳定隔离安装树记录路径（A2/A3）。当前仍不包含 R-02 安全整树盘点、R-10 历史发布验证的产品实现、真实 Kimi/WorkBuddy 公开市场安装与调用门禁或 Audit 公开离线发布记录验证器。本范围说明不构成远端发布记录或消费者升级指引。
 
 Foundation 三包精确依赖已发布的 0.16.0。新生成的 Kimi/CodeBuddy 同仓计划在 verify 阶段调用正式 `runPluginVerification`，把完整冻结载荷交给 Foundation，并记录最小的 `install-only` 观察收据。Kimi 映射为 `kimi-code`，CodeBuddy 映射为兼容的 `workbuddy`。`observed` 与 `payloadMatches` 只表示机制观察结果，不代表远端已发布或 release-skill 已完成领域验证。独立市场来源、真实市场安装和宿主调用仍是人工后续任务。
 
@@ -101,12 +98,10 @@ Foundation 三包精确依赖已发布的 0.16.0。新生成的 Kimi/CodeBuddy
 > `marketplace-index-render`（以 `targets` 形态声明），以及
 > `proposal-inbox`、`marketplace-registry-entry`、`docs-refresh`、
 > `notify-handoff`（以 `hooks` 形态声明）。`proposal-inbox` 通过 git-push 或
-> local-file 传输投递机器可读更新提案，供下游自治消费；未声明 target 时
+> local-file 传输投递机器可读更新提案，并记录送达结果。接收端按照接收端自己的 runbook
+> 和治理要求应用、渲染并公开同步；送达成功不证明这些接收端步骤已经完成。未声明 target 时
 > 退化为 `notify-handoff` 行为而非报错。`notify-handoff` 是零写地板：
-> 只渲染确定性的人工同步清单。release-skill 自己也在使用该能力：本仓库的
-> 项目配置声明了一个 `proposal-inbox`（git-push）hub 提案，指向公开仓
-> `skill-family-hub`，将在 v0.7.0 发布的 postVerify 阶段经自身的
-> checkpoint 批准投递。
+> 只渲染确定性的人工同步清单。
 <!-- release-skill:capability:postpublish-presets -->
 
 <!-- release-skill:capability:postverify-stage -->
@@ -203,8 +198,8 @@ Claude Code、CodeBuddy、WorkBuddy 和 Codex 从 bundled-family 市场
 > `/plugin marketplace add https://github.com/ifoohoo/release-skill`——
 > 或设置 `CLAUDE_CODE_PLUGIN_PREFER_HTTPS=1`。
 
-**Kimi Code：** Kimi Code 没有市场安装接口，需手动安装并钉死到特定 release
-tag——见 [INSTALL.zh-CN.md](INSTALL.zh-CN.md#安装为-kimi-code-插件)。
+**Kimi Code：** release-skill 当前无可脚本化安装接口接入，只采用钉死版本的交互式
+TUI 路径，见 [INSTALL.zh-CN.md](INSTALL.zh-CN.md#安装为-kimi-code-插件)。
 
 CodeBuddy、Codex 和 Kimi Code 的完整命令见 [INSTALL.zh-CN.md](INSTALL.zh-CN.md)。
 
@@ -642,16 +637,21 @@ release-skill ship --root "$PROJECT" --hook-approval "$HOOK_APPROVAL_PATH" --jso
 | `npm` | 带 CLI 入口的 npm 包 | `npm install -g release-skill` |
 | `claude-plugin` | `adapters/claude/` 下的自包含闭包 | 自动化 marketplace 检查点 |
 | `codex-plugin` | `adapters/codex/` 下的自包含闭包 | 自动化 marketplace 检查点 |
-| `kimi-plugin` | 自包含闭包（无可脚本化安装接口） | 发布后非阻塞人工任务 |
+| `kimi-plugin` | 自包含闭包（release-skill 无可脚本化安装接口接入） | 发布后非阻塞人工任务 |
 | `codebuddy-plugin` | 生成的 `adapters/workbuddy/`，带 `.codebuddy-plugin/plugin.json` | 发布后非阻塞人工任务 |
 
 每个适配器闭包都自带 CLI、skills 和 schemas 副本，安装后无需外部依赖即可运行。Claude/Codex 验证是自动化的；Kimi Code 和 CodeBuddy/WorkBuddy 以 `manualFollowUps` 返回并标记 `verifiedBySystem: false`，其完成情况不阻塞自动发布进入 `VERIFIED`。
 
 发布达到 `VERIFIED` 后，可选的 `release-finish` 工作流可以按冻结市场身份更新 Claude
-和 Codex，也可以在同一个受控 TUI 会话中迁移或更新 Kimi，并核对真实受管载荷。
+和 Codex。任一市场需要重绑时，必须在该宿主第一条写命令前只读证明冻结仓库、引用和
+提交；预检失败时不修改该宿主，也不阻止其他已选宿主继续。流程也可以在同一个受控
+TUI 会话中迁移或更新 Kimi，并核对真实受管载荷。
 对于已有的 bundled-family CodeBuddy/WorkBuddy 条目，只有冻结标签与可变分支都解析到
 冻结提交时才允许更新。该流程要求用户明确同意，且不改变发布状态。目标缺失、使用
 standalone 来源、远端不可访问或身份含糊时仍转人工处理，不修改宿主。
+Kimi 的有效配置根依次取显式 `kimiHome`、`KIMI_CODE_HOME`、`~/.kimi-code`，TUI 与
+操作后观察使用同一根。出现 `Trust this folder?`、未知界面、超时、提前退出，或无法
+证明插件身份时，流程返回人工处理或失败结果，不确认目录信任。
 WorkBuddy 本机更新仅支持 macOS；其他平台返回不支持并跳过。计划声明 postVerify hook 时，
 release-finish 必须接收 `ship` 产出的已完成 postVerify run，不能直接使用较早的
 verify run；核心 prepare、publish、verify 流程仍跨平台。

package/adapters/claude/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "release-skill",
       "source": "./",
-      "version": "0.9.7",
+      "version": "0.9.9",
       "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
       "author": {
         "name": "广州市风荷科技有限公司"

package/adapters/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.7",
+  "version": "0.9.9",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"