[imxyanua]

Summary Require the Kimi Windows Node 22/26 suite before a release can publish. Show Git, npm and GitHub publication outcomes separately, and document how to resume a partially completed release. A rerun from the original source SHA now reuses the published Git commit. Retrying an older tag after a newer release is refused before the npm stage, including from an already-packed checkout. ## Evidence - The regression reproduced a second release commit when rerunning from the original source SHA. - Bare temporary repositories cover original-source and packed-checkout retries, forward-only release order and rejection of older tags. - The actual workflow shell commands are exercised with stub npm/GitHub commands, covering a failure at each later stage, successful recovery and a further no-op retry. - Six targeted release cases passed 6/6 with no skips on Windows Node 22 and 26 under Git Bash, using disposable bare Git and stub npm/GitHub commands. bash -n also passed. Publication assertions and hook timeouts are retained. No real release was performed. - Includes the captured-null owner fix also on #70 so the existing Kimi Windows hook stays within its CI budget. ## Merge Danger Two-way. Git, npm and GitHub remain separate publication stages. Completed stages stay available, and maintainers can rerun a failed publish job for the current tag. Published npm bytes require a new version for a source change.

[evomap-aiqa-bot]

Sentinel 已审核此变更，未发现已核验问题，但发现需要人工确认的风险。

另有 1 个需要人工确认的风险；黄色 advisory 不阻塞合并，建议开发 agent review advisory 评论并逐条确认。

开发 agent 查询详情： 调用 MCP 工具 sentinel_pr_review_context，传入 owner_repo="evomap/evolver-agent-plugin"、pr_number=76、head_sha="2c8b8e269b251841ecc19e5a396d6528ab9c2290"，并按条目追加 finding_id 或 finding_key。

由 Sentinel 审核 · 目标提交 2c8b8e269b25

[evomap-aiqa-bot]

Sentinel 保留了 1 个尚未确认的审核候选。这些黄色条目不阻塞合并；红色 P0/P1 与其他独立硬门禁不受影响。 单一猜测、缺少变更行证据或纯 checklist 的候选会统一降为 P3。
开发 agent：请 review 以下 advisory，并逐条给出“已验证无风险 / 已修复 / 转为后续事项”的结论；不要只做整体确认。

• [P1] 旧版本检查无法阻止并发发布回退 npm latest — 新检查只在 Git 发布阶段读取一次 release 分支，检查与后续 npm --tag latest 发布不在同一锁...(truncated) · scripts/publish-tag.sh · advisory_705d9a32fa22d55cf3d06909

需要完整证据时，可用行末 finding_key 查询 Sentinel PR review context。

由 Sentinel 审核 · 目标提交 2c8b8e269b25

[evomap-aiqa-bot]

Sentinel 已审核此变更，未发现已核验问题，但发现需要人工确认的风险。

另有 1 个需要人工确认的风险；黄色 advisory 不阻塞合并，建议开发 agent review advisory 评论并逐条确认。

开发 agent 查询详情： 调用 MCP 工具 sentinel_pr_review_context，传入 owner_repo="evomap/evolver-agent-plugin"、pr_number=76、head_sha="cfe9736fa247193bfac7581a5c822aeb67f263c9"，并按条目追加 finding_id 或 finding_key。

由 Sentinel 审核 · 目标提交 cfe9736fa247

[evomap-aiqa-bot]

Sentinel 保留了 1 个尚未确认的审核候选。这些黄色条目不阻塞合并；红色 P0/P1 与其他独立硬门禁不受影响。 单一猜测、缺少变更行证据或纯 checklist 的候选会统一降为 P3。
开发 agent：请 review 以下 advisory，并逐条给出“已验证无风险 / 已修复 / 转为后续事项”的结论；不要只做整体确认。

• [P3] 成功发布的摘要仍提示修复失败并重跑 — Summarize publication 使用 if: always()，并无条件输出“Fix the failure and rerun the failed workflow jobs�...(truncated) · .github/workflows/release.yml · advisory_ed6c10ab28b2c8c757674c02

需要完整证据时，可用行末 finding_key 查询 Sentinel PR review context。

由 Sentinel 审核 · 目标提交 cfe9736fa247

[forrestlinfeng]

Merged with maintainer changes: main merged in (dropping the owner-retention commit superseded by #68) and the header comment in scripts/publish-tag.sh corrected to say when an already-published tag is left alone. Verified: a rerun fetches the remote tag and returns early when that commit already holds dist/; npm and GitHub Release are skipped when they already exist; an older tag is refused before the npm step; publish now also waits for windows-kimi. Thanks!