release-skill 0.9.9 → 0.9.11

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.9",
+  "version": "0.9.11",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codebuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.9",
+  "version": "0.9.11",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.9",
+  "version": "0.9.11",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"
@@ -19,7 +19,7 @@
     ],
     "defaultPrompt": [
       "Assess this project for release readiness.",
-      "Prepare a release plan for version 0.9.9.",
+      "Prepare a release plan for version 0.9.11.",
       "Help me understand the release workflow."
     ]
   }

package/.kimi-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.9",
+  "version": "0.9.11",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/CHANGELOG.md

@@ -1,5 +1,50 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.9.11 locale=en baseline=sha256:c8015d6a26b39a9056c121425b8758a108048d78815476e7bf3d2711cec6ee25 -->
+## [0.9.11] - 2026-09-04
+
+0.9.11 is a local source candidate that makes first-release verification advance its public baseline and permits an explicit empty distribution list for GitHub-only plugin releases. It consumes the three Foundation packages at the exact 0.17.0 release. This note is not evidence of publication, real-host acceptance, consumer installation verification, or independent acceptance.
+
+### Security
+
+- First-release baseline advancement runs only after immutable publication verification succeeds. Configuration writes are validated and atomic; restoration failures retain their phase and publication-state details in verification evidence without changing a successful publication result.
+- An empty distribution list does not skip the GitHub snapshot, tag, or GitHub Release actions, and it does not grant a marketplace registration.
+- Hub branch updates use compare-and-swap against the observed branch head. A partial Hub publication is retained for recovery and is never rolled back or force-pushed.
+
+### Changed
+
+- After a release reaches VERIFIED, a unit whose previous public baseline is `mode: none` is advanced to a bound baseline with the resolved repository and ref plus the exact frozen commit, tree, and manifest digest. Mixed plans and custom in-root config paths use the same existing atomic update path, preserve an explicit GitHub host, and report only units that changed.
+- `releaseUnits[].distributions` remains required but may now be an explicit empty list. Such a unit still freezes and publishes its GitHub snapshot, tag, and GitHub Release, while npm and marketplace actions are omitted; postPublish and postVerify hooks remain independent.
+- Pinned `skill-family-contracts`, `skill-family-harness-node`, and `skill-family-engineering-kit` dependencies were upgraded from 0.16.0 to the exact published 0.17.0 versions.
+- Skill Family Hub remains the single marketplace source. After verification, the project-private postVerify hook applies the Hub proposal and publishes its private entry and public snapshot through GitHub's Git Data API.
+
+### Upgrade Notes
+
+Remove any `release-skill` standalone marketplace registration, add or update `ifoohoo/skill-family-hub`, and use `release-skill@skill-family-hub`. Use `distributions: []` only when the release unit is intentionally GitHub-only and marketplace registration is handled by an independent verified workflow. Existing non-empty distribution lists keep their behavior. After installing or reloading the official 0.9.11 release, a historical first release may be reverified without republishing; confirm that its configured previous public baseline changed from `none` to the verified frozen coordinates.
+<!-- release-skill:changelog:end version=0.9.11 locale=en -->
+
+
+<!-- release-skill:changelog:start version=0.9.10 locale=en baseline=sha256:4cd32926b3d8e0da10ec909f58268636c3e6025f59cd7f24d313460cf5524b7b -->
+## [0.9.10] - 2026-09-04
+
+0.9.10 is a local source candidate that removes release-skill's private marketplace and makes Skill Family Hub the single marketplace source. It consumes the three Foundation packages at the exact 0.16.0 release. The release workspace publishes a verified entry and the Hub's seven-file public snapshot through GitHub's Git Data API after verification. This note is not evidence of publication, real-host acceptance, consumer installation verification, or independent acceptance.
+
+### Security
+
+- Hub branch updates are compare-and-swap writes against the observed main commit. Concurrent movement fails closed; a public-Hub failure after the private commit is retained as a recoverable partial result and is never rolled back or force-pushed.
+
+### Changed
+
+- Removed the bundled Claude, Codex, and adapter marketplace indexes from the release-skill package. Plugin manifests remain available for installation through Skill Family Hub.
+- Installation guidance now uses `ifoohoo/skill-family-hub` and `release-skill@skill-family-hub` for Claude Code, Codex, CodeBuddy, and WorkBuddy.
+- After a release reaches VERIFIED, the project-private postVerify hook applies the proposal with the Hub's own receiver, runs the Hub release gate once, and publishes the private and public Hub commits through GitHub's Git Data API with non-forced branch updates.
+
+### Upgrade Notes
+
+Remove any `release-skill` standalone marketplace registration from each host, add or update `ifoohoo/skill-family-hub`, and install `release-skill@skill-family-hub`.
+<!-- release-skill:changelog:end version=0.9.10 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.9.9 locale=en baseline=sha256:44d7cba7d5e4cbe182157c8b200e3a2d9b494d61a9555cd5af5c62c97a60fb37 -->
 ## [0.9.9] - 2026-09-04
 

package/INSTALL.md

@@ -2,7 +2,7 @@
 
 [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.9.9 -->
+<!-- release-skill:release-version: 0.9.11 -->
 ## Prerequisites
 
 - Node.js 22.0.0 or later
@@ -35,12 +35,11 @@ release-skill help
 
 You should see the version number and the list of available commands.
 
-## Install as a plugin (bundled-family marketplace — recommended)
+## Install as a plugin (Skill Family Hub — recommended)
 
 Claude Code, CodeBuddy, WorkBuddy, and Codex install release-skill from the
-bundled-family marketplace [ifoohoo/release-skill](https://github.com/ifoohoo/release-skill).
-The plugin repository itself carries the marketplace manifest
-(`.claude-plugin/marketplace.json`), so no external marketplace is required.
+central [Skill Family Hub](https://github.com/ifoohoo/skill-family-hub).
+The release-skill repository carries plugin manifests but no marketplace index.
 release-skill currently invokes no scriptable install API for Kimi Code — see the
 [Kimi Code section](#install-as-a-kimi-code-plugin). Add the marketplace once,
 then install the plugin:
@@ -48,21 +47,21 @@ then install the plugin:
 > **Prerequisite: GitHub access.** The `owner/repo` shorthand makes Claude Code
 > clone via `git@github.com:...` (SSH), which requires a GitHub public key
 > configured on this machine. If you do not use SSH, either pass the full HTTPS
-> URL — `/plugin marketplace add https://github.com/ifoohoo/release-skill` — or
+> URL — `/plugin marketplace add https://github.com/ifoohoo/skill-family-hub` — or
 > set `CLAUDE_CODE_PLUGIN_PREFER_HTTPS=1`.
 
 **Claude Code** (interactive session):
 
 ```
-/plugin marketplace add ifoohoo/release-skill
-/plugin install release-skill@release-skill
+/plugin marketplace add ifoohoo/skill-family-hub
+/plugin install release-skill@skill-family-hub
 ```
 
 **CodeBuddy / WorkBuddy:**
 
 ```bash
-codebuddy plugin marketplace add ifoohoo/release-skill
-codebuddy plugin install release-skill@release-skill
+codebuddy plugin marketplace add ifoohoo/skill-family-hub
+codebuddy plugin install release-skill@skill-family-hub
 ```
 
 WorkBuddy desktop installs only through a registered marketplace: after the
@@ -71,7 +70,7 @@ WorkBuddy desktop installs only through a registered marketplace: after the
 **OpenAI Codex:**
 
 ```bash
-codex plugin marketplace add ifoohoo/release-skill
+codex plugin marketplace add ifoohoo/skill-family-hub
 ```
 
 Then install `release-skill` from the interactive `/plugins` browser.
@@ -84,15 +83,12 @@ task and does not verify its completion.
 
 ### Alternative: direct repository install (advanced)
 
-The unified marketplace above is the supported primary path. Direct
-installation from the release repository remains available for advanced
-scenarios:
+The Hub marketplace above is the supported primary path. Direct installation
+remains available only where the host supports a repository URL:
 
-- Claude Code: `/plugin marketplace add ifoohoo/release-skill`, then
-  `/plugin install release-skill@release-skill`.
 - Kimi Code: the version-pinned `/plugins install <release-tag URL>` documented
   in the [Kimi Code section](#install-as-a-kimi-code-plugin) below.
-- CodeBuddy: single-session use directly from a source checkout via
+- CodeBuddy: single-session use from a source checkout via
   `--plugin-dir <path>/adapters/workbuddy` (see the
   [CodeBuddy/WorkBuddy section](#install-as-a-codebuddyworkbuddy-plugin)).
 
@@ -114,7 +110,7 @@ tag pinned to the exact version (never the bare repository URL, which installs
 the latest release or default branch), confirm the trust prompt, then reload:
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.9
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.11
    /plugins reload
    ```
 

package/INSTALL.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.9.9 -->
+<!-- release-skill:release-version: 0.9.11 -->
 ## 前置条件
 
 - Node.js 22.0.0 或更高版本
@@ -32,32 +32,31 @@ release-skill help
 
 输出中应包含版本号和可用命令列表。
 
-## 安装为插件（bundled-family 市场——推荐）
+## 安装为插件（Skill Family Hub——推荐）
 
-Claude Code、CodeBuddy、WorkBuddy 和 Codex 从 bundled-family 市场
-[ifoohoo/release-skill](https://github.com/ifoohoo/release-skill)
-安装 release-skill。插件仓库自身携带市场清单
-（`.claude-plugin/marketplace.json`），无需外部市场。release-skill 当前没有接入
+Claude Code、CodeBuddy、WorkBuddy 和 Codex 从统一的
+[Skill Family Hub](https://github.com/ifoohoo/skill-family-hub)
+安装 release-skill。release-skill 仓库只携带插件清单，不再携带市场索引。当前没有接入
 Kimi Code 的可脚本化安装接口，见 [Kimi Code 小节](#安装为-kimi-code-插件)。先添加一次市场，再安装
 插件：
 
 > **前置条件：GitHub 访问。** `owner/repo` 简写会让 Claude Code 通过
 > `git@github.com:...`（SSH）克隆，需要本机配置 GitHub 公钥。如不使用 SSH，
-> 可传完整 HTTPS 地址——`/plugin marketplace add https://github.com/ifoohoo/release-skill`——
+> 可传完整 HTTPS 地址——`/plugin marketplace add https://github.com/ifoohoo/skill-family-hub`——
 > 或设置 `CLAUDE_CODE_PLUGIN_PREFER_HTTPS=1`。
 
 **Claude Code**（交互会话中）：
 
 ```
-/plugin marketplace add ifoohoo/release-skill
-/plugin install release-skill@release-skill
+/plugin marketplace add ifoohoo/skill-family-hub
+/plugin install release-skill@skill-family-hub
 ```
 
 **CodeBuddy / WorkBuddy：**
 
 ```bash
-codebuddy plugin marketplace add ifoohoo/release-skill
-codebuddy plugin install release-skill@release-skill
+codebuddy plugin marketplace add ifoohoo/skill-family-hub
+codebuddy plugin install release-skill@skill-family-hub
 ```
 
 WorkBuddy 桌面端只能通过已注册的市场安装：执行上面的 `marketplace add`
@@ -66,7 +65,7 @@ WorkBuddy 桌面端只能通过已注册的市场安装：执行上面的 `marke
 **OpenAI Codex：**
 
 ```bash
-codex plugin marketplace add ifoohoo/release-skill
+codex plugin marketplace add ifoohoo/skill-family-hub
 ```
 
 然后在交互式 `/plugins` 浏览器中安装 `release-skill`。
@@ -78,10 +77,8 @@ release-skill 当前对 Kimi Code 采用钉死版本的交互式 TUI 路径。
 
 ### 备选：直接从仓库安装（进阶）
 
-上面的统一市场是受支持的主路径。直接从发布仓库安装仍可用于进阶场景：
+上面的 Hub 市场是受支持的主路径。只有宿主支持仓库 URL 时，才能直接安装：
 
-- Claude Code：`/plugin marketplace add ifoohoo/release-skill`，然后
-  `/plugin install release-skill@release-skill`。
 - Kimi Code：下文 [Kimi Code 小节](#安装为-kimi-code-插件)中版本钉死的
   `/plugins install <release-tag URL>`。
 - CodeBuddy：源码检出后通过 `--plugin-dir <path>/adapters/workbuddy`
@@ -104,7 +101,7 @@ release-skill 当前只采用并验证 Kimi Code 的交互式 TUI 路径，**无
 （切勿使用裸仓库地址，它会安装最新 release 或默认分支），确认信任提示后重新加载：
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.9
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.11
    /plugins reload
    ```
 

package/README.md

@@ -2,7 +2,7 @@
 
 [简体中文](README.zh-CN.md) · Installation: [English](INSTALL.md) / [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.9.9 -->
+<!-- release-skill:release-version: 0.9.11 -->
 Release preparation for Claude Code, CodeBuddy, WorkBuddy, Codex, and Kimi Code, with human-edited files kept intact.
 
 release-skill helps a maintainer answer three questions: what will be released,
@@ -14,31 +14,30 @@ Setup surfaces only the deterministic `compactSummary` review view; the full
 report stays in a temporary session directory.
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.9.9** (2026-09-04)
+**0.9.11** (2026-09-04)
 
-0.9.9 is a local source candidate that makes Kimi Code plugin trust compare the complete displayed installation identity with the frozen URL. It consumes the three Foundation packages at the exact 0.16.0 release. This note is not evidence of publication, real-host acceptance, consumer installation verification, or independent acceptance.
+0.9.11 is a local source candidate that makes first-release verification advance its public baseline and permits an explicit empty distribution list for GitHub-only plugin releases. It consumes the three Foundation packages at the exact 0.17.0 release. This note is not evidence of publication, real-host acceptance, consumer installation verification, or independent acceptance.
 
 **Security**
 
-- Kimi Code extracts the complete installation identity from the plugin trust dialog, removes ANSI/OSC control sequences and soft wrapping, and compares the result exactly with the frozen installation URL. Similar repository names and tag prefixes or suffixes fail closed.
-- Claude and Codex continue to verify the frozen marketplace repository, ref, and commit before the first marketplace or plugin write when a rebind is required. An unreachable remote, missing ref, or commit mismatch returns `MANUAL_REQUIRED` for that host with zero host writes; other selected hosts continue.
-- Kimi Code continues only when the selected row is confirmed as `Trust and install`. A `Trust this folder?` dialog, an unknown screen, timeout, EOF, or mismatched identity fails closed before unintended confirmation.
-- Any host plan remains a qualified frozen-plan path and requires a VERIFIED-run from the same release lineage before host acceptance; this source candidate does not provide that acceptance.
+- First-release baseline advancement runs only after immutable publication verification succeeds. Configuration writes are validated and atomic; restoration failures retain their phase and publication-state details in verification evidence without changing a successful publication result.
+- An empty distribution list does not skip the GitHub snapshot, tag, or GitHub Release actions, and it does not grant a marketplace registration.
+- Hub branch updates use compare-and-swap against the observed branch head. A partial Hub publication is retained for recovery and is never rolled back or force-pushed.
 
 **Changed**
 
-- The English and Chinese README scope descriptions identify 0.9.9 as the current source candidate.
-- The public release-finish flow continues to treat a `proposal-inbox` postVerify hook as proposal delivery plus delivery evidence. The receiver applies, renders, and synchronizes the proposal under its own runbook and governance; no Hub repository or push sequence is built into the public Skill.
-- Kimi Code continues to resolve its effective configuration root from explicit `kimiHome`, then `KIMI_CODE_HOME`, then `~/.kimi-code`; the TUI process and post-install observation use the same root.
-- The current 0.9.9 candidate keeps the narrow R-05 Hook cache v2 consumer path, keeps the CodeBuddy plugin entry explicit as `marketplace: release-skill`, and keeps `--root <project-root>` in release-finish local-finish examples. Foundation dependencies remain pinned to the three released 0.16.0 packages.
+- After a release reaches VERIFIED, a unit whose previous public baseline is `mode: none` is advanced to a bound baseline with the resolved repository and ref plus the exact frozen commit, tree, and manifest digest. Mixed plans and custom in-root config paths use the same existing atomic update path, preserve an explicit GitHub host, and report only units that changed.
+- `releaseUnits[].distributions` remains required but may now be an explicit empty list. Such a unit still freezes and publishes its GitHub snapshot, tag, and GitHub Release, while npm and marketplace actions are omitted; postPublish and postVerify hooks remain independent.
+- Pinned `skill-family-contracts`, `skill-family-harness-node`, and `skill-family-engineering-kit` dependencies were upgraded from 0.16.0 to the exact published 0.17.0 versions.
+- Skill Family Hub remains the single marketplace source. After verification, the project-private postVerify hook applies the Hub proposal and publishes its private entry and public snapshot through GitHub's Git Data API.
 
 **Upgrade Notes**
 
-Prepare and approve a new 0.9.9 production plan for these changes. After verify reaches `VERIFIED`, complete every declared postVerify hook with its own immutable checkpoint approval before running release-finish. Real-host acceptance can begin only after 0.9.9 is officially published and VERIFIED; the official 0.9.9 entry must be installed or reloaded first. A source candidate, an older installed entry, or the mere existence of plan and run files cannot complete real-host acceptance. Each selected host must complete a first successful update. On the second run, Claude, Kimi, CodeBuddy, and WorkBuddy must report `ALREADY_CURRENT`; Codex may report `UPDATED` only when it reinstalls the same exact 0.9.9 frozen reference, payload validation passes, and `restartRequired=true` is declared. The local updater uses the Kimi Code TUI path verified for 0.40.1; it does not switch to a web or REST installation path. Confirm that the complete frozen installation URL shown by the plugin trust dialog is exact, and never approve a folder-trust dialog as part of plugin installation. This candidate does not claim that 0.9.9 has already been published or VERIFIED.
+Remove any `release-skill` standalone marketplace registration, add or update `ifoohoo/skill-family-hub`, and use `release-skill@skill-family-hub`. Use `distributions: []` only when the release unit is intentionally GitHub-only and marketplace registration is handled by an independent verified workflow. Existing non-empty distribution lists keep their behavior. After installing or reloading the official 0.9.11 release, a historical first release may be reverified without republishing; confirm that its configured previous public baseline changed from `none` to the verified frozen coordinates.
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **Current boundary:** v0.9.9 is the current source candidate. This README
+> **Current boundary:** v0.9.11 is the current source candidate. This README
 > records intended scope and verification boundaries; it is not evidence of
 > publication, consumer-installation verification, or independent acceptance.
 > Release availability must be established from the corresponding release records
@@ -62,7 +61,7 @@ Prepare and approve a new 0.9.9 production plan for these changes. After verify
 > publish global preflight.
 
 <!-- release-skill:capability:safe-first-command -->
-> **Production path verified since the v0.1.1 milestone; v0.9.9 is the current
+> **Production path verified since the v0.1.1 milestone; v0.9.11 is the current
 > source candidate. Its README does not establish publication,
 > consumer-installation verification, or independent acceptance.**
 > The npm-installed CLI is the supported user entry. Source checkout
@@ -91,20 +90,22 @@ checkpoints remain intact and use matching-version recovery. Evidence v1 stays
 read-only; v2 uses a closed top level with phase extensions in `details`.
 Summaries and recovery suggestions are diagnostic, never publication authority.
 
-The current 0.9.9 candidate includes the narrow R-05 Hook cache v2 consumer
+The current 0.9.11 candidate includes the narrow R-05 Hook cache v2 consumer
 path, the public `postverify` path, and the stable isolated install-tree record
-path (A2/A3). It still
+path (A2/A3). It also removes the repository's own marketplace indexes and
+uses Skill Family Hub as the single marketplace source. It still
 excludes R-02 safe full-tree inventory, R-10 historical-release verification
 implementation, real Kimi/WorkBuddy public-marketplace installation and
 invocation gates, and an Audit public offline release-record verifier.
-Foundation dependencies are pinned to the three released 0.16.0 packages.
-For new bundled-family Kimi/CodeBuddy plans, verify calls the released
+Foundation dependencies are pinned to the three released 0.17.0 packages.
+For Kimi/CodeBuddy plans that still use the bundled-family distribution form,
+verify calls the released
 `runPluginVerification` entry with the complete frozen payload and records a
 minimal `install-only` observation receipt. Kimi maps to `kimi-code`; CodeBuddy
 maps to the compatible `workbuddy` host. `observed` and `payloadMatches` are
 mechanism facts, not remote publication or release-domain VERIFIED facts.
-Standalone marketplace sources, real marketplace installation, and host
-invocation remain manual follow-ups.
+Real marketplace installation and host invocation remain post-release host
+operations.
 This scope summary is not a remote publication record or a consumer upgrade instruction.
 
 <!-- release-skill:maturity:distribute-v1 -->
@@ -237,17 +238,17 @@ npx release-skill help
 
 **Plugin (Claude Code / CodeBuddy / WorkBuddy / Codex):**
 
-Claude Code, CodeBuddy, WorkBuddy, and Codex install from the bundled-family
-marketplace `ifoohoo/release-skill`:
+Claude Code, CodeBuddy, WorkBuddy, and Codex install from the central
+Skill Family Hub marketplace:
 
 ```
-/plugin marketplace add ifoohoo/release-skill
-/plugin install release-skill@release-skill
+/plugin marketplace add ifoohoo/skill-family-hub
+/plugin install release-skill@skill-family-hub
 ```
 
 > **Prerequisite: GitHub access.** The `owner/repo` shorthand makes Claude Code
 > clone via SSH. If you do not use SSH, pass the full HTTPS URL —
-> `/plugin marketplace add https://github.com/ifoohoo/release-skill` — or set
+> `/plugin marketplace add https://github.com/ifoohoo/skill-family-hub` — or set
 > `CLAUDE_CODE_PLUGIN_PREFER_HTTPS=1`.
 
 **Kimi Code:** release-skill currently invokes no scriptable install API for
@@ -519,6 +520,13 @@ releaseUnits:
       branchStrategy: create-release-branch
 ```
 
+`distributions` is required but may be an explicit empty array. Use
+`distributions: []` when release-skill should publish only the unit's GitHub
+snapshot, tag, and GitHub Release, with no npm publish or marketplace consumer
+action. A `postPublish` declaration, including hooks whose phase is
+`postVerify`, remains active. This is the intended shape for a plugin that is
+added to a central Hub only after the release has reached `VERIFIED`.
+
 `version.source` is resolved relative to that release unit's `source` directory
 (`version.source` 相对于该发布单元的 `source` 目录解析). A monorepo with
 separate npm and plugin units defines multiple release units:

package/README.zh-CN.md

@@ -2,37 +2,36 @@
 
 [English](README.md) · 安装指南：[中文](INSTALL.zh-CN.md) / [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.9.9 -->
+<!-- release-skill:release-version: 0.9.11 -->
 面向 Claude Code、CodeBuddy、WorkBuddy、Codex 和 Kimi Code 的发布准备工具，完整保留人工维护的文件内容。
 
 release-skill 帮助维护者回答三个问题：准备发布什么、还有哪些检查未通过、最终发布的内容是什么。它不重新生成、也不回写项目源文件。`prepare` 把每个配置的公开文件复制到隔离快照并验证字节——先冻结并供人工审阅，再从同一份冻结产物发布。`setup` 只显示确定性的 `compactSummary` 审阅视图，完整报告保留在临时会话目录中。
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.9.9** (2026-09-04)
+**0.9.11** (2026-09-04)
 
-0.9.9 是修正 Kimi Code 插件信任身份精确比较的本地源码候选。三项 Foundation 依赖均精确消费已发布的 0.16.0。本说明不代表已经发布、完成真实宿主验收、完成消费者安装验证或通过独立验收。
+0.9.11 是修复首次发布验证后基线推进、并允许 GitHub-only 插件发布显式使用空分发列表的本地源码候选，三项 Foundation 依赖均精确升级到已发布的 0.17.0。本说明不代表已经发布、完成真实宿主验收、完成消费者安装验证或通过独立验收。
 
 **安全**
 
-- Kimi Code 会从插件信任对话框提取完整安装身份，清除 ANSI/OSC 控制序列并归一软换行，再与冻结安装 URL 精确比较。相似仓库名、tag 前缀或 tag 后缀均失败关闭。
-- Claude 和 Codex 继续在确实需要重绑时，于第一条市场或插件写命令前验证冻结的 marketplace 仓库、ref 和 commit。远端不可达、ref 缺失或 commit 不一致时，该宿主以零写入返回 `MANUAL_REQUIRED`，其他已选宿主继续。
-- Kimi Code 只有在选中项确认为 `Trust and install` 时才继续。出现 `Trust this folder?`、未知界面、超时、EOF 或身份不一致时，在意外确认前失败关闭。
-- 任何宿主计划都必须是合格冻结计划，并要求同一发布谱系的 VERIFIED run 才能开始宿主验收；本源码候选不提供该验收。
+- 首次发布基线只在不可变发布内容验证成功后推进。配置写入会先验证并采用原子更新；若恢复失败，验证证据会保留阶段与发布状态详情，同时不把已经成功的发布结果降级。
+- 空分发列表不会跳过 GitHub 快照、tag 或 GitHub Release，也不会自动获得市场登记。
+- Hub 分支更新以已观察的分支头做比较后写入。Hub 局部发布会保留为可恢复状态，不回滚、不覆盖，也不强推。
 
 **变更**
 
-- 中英文 README 的范围说明统一把 0.9.9 标为当前源码候选。
-- 公共 release-finish 继续只把 `proposal-inbox` postVerify hook 定义为提案送达和送达证据。接收端按自身 runbook 和治理应用、渲染与同步提案；公共 Skill 不内置 Hub 仓库或推送顺序。
-- Kimi Code 有效配置根继续依次取显式 `kimiHome`、`KIMI_CODE_HOME` 和 `~/.kimi-code`；TUI 进程与安装后观察使用同一根目录。
-- 当前 0.9.9 候选保留窄范围的 R-05 Hook cache v2 消费路径，保留 CodeBuddy 插件显式的 `marketplace: release-skill` 条目，并在 release-finish 本机收尾示例中保留 `--root <project-root>`。Foundation 三包继续精确依赖已发布的 0.16.0。
+- 发布达到 VERIFIED 后，`previousPublicBaseline` 为 `mode: none` 的单元会转为 bound 基线，写入解析后的仓库与 ref，以及本次冻结的精确 commit、tree 和 manifest digest。混合计划与根目录内的自定义配置路径复用既有原子更新路径，保留显式 GitHub host，并且只报告实际发生变化的单元。
+- `releaseUnits[].distributions` 仍为必填字段，但现在可以显式设置为空列表。该单元仍会冻结并发布 GitHub 快照、tag 和 GitHub Release，只省略 npm 与市场动作；postPublish 和 postVerify hook 继续独立执行。
+- 精确固定的 `skill-family-contracts`、`skill-family-harness-node` 和 `skill-family-engineering-kit` 依赖从 0.16.0 升级到已发布的 0.17.0。
+- Skill Family Hub 继续作为唯一市场来源。验证完成后，项目私有的 postVerify hook 会应用 Hub 提案，并通过 GitHub Git Data API 发布 Hub 私有条目和公开快照。
 
 **升级说明**
 
-采用这些修复时，应准备并批准新的 0.9.9 production plan。verify 达到 `VERIFIED` 后，先用各 hook 独立的不可变 checkpoint approval 完成所有已声明 postVerify，再运行 release-finish。真实宿主验收只有在 0.9.9 正式发布并达到 VERIFIED 后才能开始；必须先安装或重载正式的 0.9.9 入口。源码候选、旧的已安装入口，或仅存在计划和运行文件，都不能完成真实宿主验收。每个已选宿主都必须完成首次成功更新。第二次运行时，Claude、Kimi、CodeBuddy 和 WorkBuddy 必须返回 `ALREADY_CURRENT`；Codex 可以返回 `UPDATED`，但只有在重新安装同一精确 0.9.9 冻结引用、载荷验证通过并声明 `restartRequired=true` 时才允许这样返回。本机 updater 采用已针对 Kimi Code 0.40.1 验证的 TUI 路径，不切换到 Web 或 REST 安装路径。插件信任界面显示的完整冻结安装 URL 必须精确一致；插件安装过程中不得批准目录信任界面。本候选不宣称 0.9.9 已经发布或达到 VERIFIED。
+删除各宿主中独立的 `release-skill` 市场登记，添加或更新 `ifoohoo/skill-family-hub`，并使用 `release-skill@skill-family-hub`。仅在发布单元有意采用 GitHub-only 发布、且市场登记由独立的已验证流程处理时使用 `distributions: []`。既有非空分发列表的行为不变。安装或重新加载正式发布并已验证的 0.9.11 后，可以直接重新验证历史首次发布，无需重复发布；随后应确认配置中的上一公开基线已从 `none` 更新为本次验证的精确冻结坐标。
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **当前边界：** v0.9.9 只是当前源码候选。本 README 记录预期范围与验证边界，
+> **当前边界：** v0.9.11 只是当前源码候选。本 README 记录预期范围与验证边界，
 > 不代表已经发布、完成消费者安装验证或通过独立验收。
 > 版本可用性以对应发布记录及发布后验证结果为准。
 > v0.4.1 是更早的已发布里程碑（v0.2.2 曾处于已发布状态，后因平台验证收敛修复而更新）。
@@ -48,7 +47,7 @@ release-skill 帮助维护者回答三个问题：准备发布什么、还有哪
 > 远端唯一性检查在 `publish` 全局预检执行。
 
 <!-- release-skill:capability:safe-first-command -->
-> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.9.9 是当前源码候选，本 README 不证明该候选已经发布、完成消费者安装验证或通过独立验收。**
+> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.9.11 是当前源码候选，本 README 不证明该候选已经发布、完成消费者安装验证或通过独立验收。**
 > npm 安装的 CLI 是受支持的用户入口；源码 checkout 保留为开发/贡献者路径。
 >
 > **第一条命令：**
@@ -66,9 +65,18 @@ marketplace 委托目标工作区发布的边界不变。
 
 旧 production 计划缺少 `sourceAuthority` 时，在外部写入前拒绝。未发生外部写入的计划必须重新 prepare 并批准新摘要，不能补写旧计划或迁移批准。已有 `PARTIAL` 保留检查点，走匹配版本的恢复路径。evidence v1 只读；v2 顶层封闭，阶段扩展放在 `details`。摘要和恢复建议只作诊断，不构成发布权威。
 
-当前 0.9.9 候选包含窄范围的 R-05 Hook cache v2 消费路径、公开 `postverify` 路径和稳定隔离安装树记录路径（A2/A3）。当前仍不包含 R-02 安全整树盘点、R-10 历史发布验证的产品实现、真实 Kimi/WorkBuddy 公开市场安装与调用门禁或 Audit 公开离线发布记录验证器。本范围说明不构成远端发布记录或消费者升级指引。
+当前 0.9.11 候选包含窄范围的 R-05 Hook cache v2 消费路径、公开 `postverify`
+路径和稳定隔离安装树记录路径（A2/A3），并删除仓库自有市场索引，统一以
+Skill Family Hub 为市场来源。当前仍不包含 R-02 安全整树盘点、R-10 历史发布验证
+的产品实现、真实 Kimi/WorkBuddy 公开市场安装与调用门禁或 Audit 公开离线发布记录
+验证器。本范围说明不构成远端发布记录或消费者升级指引。
 
-Foundation 三包精确依赖已发布的 0.16.0。新生成的 Kimi/CodeBuddy 同仓计划在 verify 阶段调用正式 `runPluginVerification`，把完整冻结载荷交给 Foundation，并记录最小的 `install-only` 观察收据。Kimi 映射为 `kimi-code`，CodeBuddy 映射为兼容的 `workbuddy`。`observed` 与 `payloadMatches` 只表示机制观察结果，不代表远端已发布或 release-skill 已完成领域验证。独立市场来源、真实市场安装和宿主调用仍是人工后续任务。
+Foundation 三包精确依赖已发布的 0.17.0。仍采用 bundled-family 分发形态的
+Kimi/CodeBuddy 计划会在 verify 阶段调用正式 `runPluginVerification`，把完整冻结载荷
+交给 Foundation，并记录最小的 `install-only` 观察收据。Kimi 映射为 `kimi-code`，
+CodeBuddy 映射为兼容的 `workbuddy`。`observed` 与 `payloadMatches` 只表示机制观察结果，
+不代表远端已发布或 release-skill 已完成领域验证。真实市场安装和宿主调用仍是发布后
+宿主操作。
 
 <!-- release-skill:maturity:distribute-v1 -->
 <!-- release-skill:capability:distribute -->
@@ -185,17 +193,16 @@ npx release-skill help
 
 **插件（Claude Code / CodeBuddy / WorkBuddy / Codex）：**
 
-Claude Code、CodeBuddy、WorkBuddy 和 Codex 从 bundled-family 市场
-`ifoohoo/release-skill` 安装：
+Claude Code、CodeBuddy、WorkBuddy 和 Codex 从统一的 Skill Family Hub 市场安装：
 
 ```
-/plugin marketplace add ifoohoo/release-skill
-/plugin install release-skill@release-skill
+/plugin marketplace add ifoohoo/skill-family-hub
+/plugin install release-skill@skill-family-hub
 ```
 
 > **前置条件：GitHub 访问。** `owner/repo` 简写会让 Claude Code 通过 SSH 克隆。
 > 如不使用 SSH，可传完整 HTTPS 地址——
-> `/plugin marketplace add https://github.com/ifoohoo/release-skill`——
+> `/plugin marketplace add https://github.com/ifoohoo/skill-family-hub`——
 > 或设置 `CLAUDE_CODE_PLUGIN_PREFER_HTTPS=1`。
 
 **Kimi Code：** release-skill 当前无可脚本化安装接口接入，只采用钉死版本的交互式
@@ -433,6 +440,12 @@ releaseUnits:
       branchStrategy: create-release-branch
 ```
 
+`distributions` 是必填字段，但可以显式设为空数组。使用
+`distributions: []` 时，release-skill 只发布该单元的 GitHub 快照、标签和
+GitHub Release，不生成 npm 发布或市场消费者动作。单元的 `postPublish` 声明仍会
+生效，包括 phase 为 `postVerify` 的 hook。这种配置适用于先把发布验证到
+`VERIFIED`，再登记到中央 Hub 的插件。
+
 `version.source` 相对于该发布单元的 `source` 目录解析（`version.source` is resolved relative to that release unit's `source` directory）。monorepo 中 npm 和插件分开发布时定义多个发布单元：
 
 ```yaml

package/adapters/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.9",
+  "version": "0.9.11",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/adapters/claude/bin/consumer-contract-vectors.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "kind": "skill-family.contracts.consumer-contract-vectors",
-  "foundationVersion": "0.16.0",
+  "foundationVersion": "0.17.0",
   "sets": [
     {
       "capabilityId": "foundation.contracts.object-validation",
@@ -15,7 +15,7 @@
           "vectorId": "foundation.contracts.object-validation.consumer-v1.indeterminate",
           "vectorSetId": "foundation.contracts.object-validation.consumer-v1",
           "capabilityId": "foundation.contracts.object-validation",
-          "foundationVersion": "0.16.0",
+          "foundationVersion": "0.17.0",
           "contractId": "skill-family-contracts:validateDocument",
           "caseClass": "indeterminate",
           "strategy": "real-pure",
@@ -31,7 +31,7 @@
           "vectorId": "foundation.contracts.object-validation.consumer-v1.negative",
           "vectorSetId": "foundation.contracts.object-validation.consumer-v1",
           "capabilityId": "foundation.contracts.object-validation",
-          "foundationVersion": "0.16.0",
+          "foundationVersion": "0.17.0",
           "contractId": "skill-family-contracts:validateDocument",
           "caseClass": "negative",
           "strategy": "real-pure",
@@ -47,7 +47,7 @@
           "vectorId": "foundation.contracts.object-validation.consumer-v1.positive",
           "vectorSetId": "foundation.contracts.object-validation.consumer-v1",
           "capabilityId": "foundation.contracts.object-validation",
-          "foundationVersion": "0.16.0",
+          "foundationVersion": "0.17.0",
           "contractId": "skill-family-contracts:validateDocument",
           "caseClass": "positive",
           "strategy": "real-pure",
@@ -71,7 +71,7 @@
           "vectorId": "foundation.harness.atomic-write.consumer-v1.indeterminate",
           "vectorSetId": "foundation.harness.atomic-write.consumer-v1",
           "capabilityId": "foundation.harness.atomic-write",
-          "foundationVersion": "0.16.0",
+          "foundationVersion": "0.17.0",
           "contractId": "skill-family-harness-node:writeFileAtomic",
           "caseClass": "indeterminate",
           "strategy": "official-fake",
@@ -84,7 +84,7 @@
           "vectorId": "foundation.harness.atomic-write.consumer-v1.negative",
           "vectorSetId": "foundation.harness.atomic-write.consumer-v1",
           "capabilityId": "foundation.harness.atomic-write",
-          "foundationVersion": "0.16.0",
+          "foundationVersion": "0.17.0",
           "contractId": "skill-family-harness-node:writeFileAtomic",
           "caseClass": "negative",
           "strategy": "official-fake",
@@ -97,7 +97,7 @@
           "vectorId": "foundation.harness.atomic-write.consumer-v1.positive",
           "vectorSetId": "foundation.harness.atomic-write.consumer-v1",
           "capabilityId": "foundation.harness.atomic-write",
-          "foundationVersion": "0.16.0",
+          "foundationVersion": "0.17.0",
           "contractId": "skill-family-harness-node:writeFileAtomic",
           "caseClass": "positive",
           "strategy": "official-fake",

package/adapters/claude/bin/error-codes.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "kind": "skill-family.contracts.error-codes",
-  "contractsVersion": "1.15.0",
+  "contractsVersion": "1.16.0",
   "policy": {
     "format": "^SFC[0-9]{4}$",
     "ranges": [