feat(ack): add project delivery workflow

skills/ack/examples/delivery.example.yaml

@@ -0,0 +1,149 @@
+version: 1
+updatedAt: "2026-08-01T10:00:00+08:00"
+project:
+  name: "notes-api"
+
+enabled: true
+defaultProfile: "review"
+
+entrypoints:
+  verify:
+    kind: make
+    target: verify
+    args: []
+    requiredSecrets: []
+    workingDirectory: "."
+    timeoutSeconds: 1800
+  build-deb:
+    kind: make
+    target: build-deb
+    args: []
+    requiredSecrets: []
+    workingDirectory: "."
+    timeoutSeconds: 3600
+  build-image:
+    kind: make
+    target: build-image
+    args: []
+    requiredSecrets: []
+    workingDirectory: "."
+    timeoutSeconds: 3600
+  upload-deb:
+    kind: script
+    path: "scripts/upload-preview-deb.sh"
+    args: []
+    requiredSecrets: ["DEB_TOKEN"]
+    workingDirectory: "."
+    timeoutSeconds: 900
+  upload-image:
+    kind: script
+    path: "scripts/publish-preview-image.sh"
+    args: []
+    requiredSecrets: ["REGISTRY_TOKEN"]
+    workingDirectory: "."
+    timeoutSeconds: 1800
+  deploy-test:
+    kind: script
+    path: "scripts/deploy-test.sh"
+    args: []
+    requiredSecrets: []
+    workingDirectory: "."
+    timeoutSeconds: 900
+  health-test:
+    kind: script
+    path: "scripts/check-test.sh"
+    args: []
+    requiredSecrets: []
+    workingDirectory: "."
+    timeoutSeconds: 300
+  rollback-test:
+    kind: script
+    path: "scripts/rollback-test.sh"
+    args: []
+    requiredSecrets: []
+    workingDirectory: "."
+    timeoutSeconds: 900
+
+artifacts:
+  service-deb:
+    type: deb
+    build: build-deb
+    outputs: ["dist/*.deb"]
+  service-image:
+    type: oci-image
+    build: build-image
+    image: "registry.example.com/notes/service"
+    platforms: ["linux/amd64", "linux/arm64"]
+
+destinations:
+  preview-apt:
+    type: apt-repository
+    channel: preview
+    endpoint: "https://packages.example.com"
+    repository: "testing"
+    upload: upload-deb
+  preview-registry:
+    type: oci-registry
+    channel: preview
+    registry: "registry.example.com"
+    repository: "notes/service"
+    upload: upload-image
+
+environments:
+  test-server:
+    type: ssh-host
+    classification: development
+    target: "notes-test"
+    deploy: deploy-test
+    healthCheck: health-test
+    rollback: rollback-test
+    mutex: "notes-test-deploy"
+
+profiles:
+  review:
+    stopAt: review_ready
+    steps:
+      - id: verify
+        action: verify
+        entrypoint: verify
+      - id: open-pr
+        action: pull-request
+        draft: true
+        remote: origin
+        baseBranch: main
+      - id: build-deb
+        action: build
+        artifact: service-deb
+      - id: publish-deb
+        action: publish
+        artifact: service-deb
+        destination: preview-apt
+      - id: deploy-test
+        action: deploy
+        artifact: service-deb
+        environment: test-server
+      - id: smoke-test
+        action: health-check
+        environment: test-server
+      - id: ready
+        action: mark-ready
+  review-image:
+    stopAt: review_ready
+    steps:
+      - id: verify
+        action: verify
+        entrypoint: verify
+      - id: open-pr
+        action: pull-request
+        draft: true
+        remote: origin
+        baseBranch: main
+      - id: build-image
+        action: build
+        artifact: service-image
+      - id: publish-image
+        action: publish
+        artifact: service-image
+        destination: preview-registry
+      - id: ready
+        action: mark-ready

skills/ack/examples/project.example.md

@@ -1,10 +1,10 @@
 # notes-web Agent 协作协议（示例，项目覆盖层）
 
-> 本项目基于 ack v0.10.0。
+> 本项目基于 ack v0.11.0。
 > 通用规范由 `/ack` 从 Skill 自身的 `references/` 读取，本文件只填项目差异。
 > 覆盖层文件放在 `docs/ack/project.md`，不占用 `AGENTS.md`。
 > ACK 不会自动修改 `AGENTS.md`、`CLAUDE.md` 或其它 Agent 指令文件。
-> `docs/ack/` 只保存 `project.md`、`tasks.yaml` 与 `knowledge.yaml`。
+> `docs/ack/` 只保存 `project.md`、`tasks.yaml`、`knowledge.yaml` 与 `delivery.yaml`。
 
 ## 项目概览
 
@@ -14,6 +14,7 @@
 - Base URL：`http://localhost:5173`
 - 任务板：`docs/ack/tasks.yaml`
 - 项目知识：`docs/ack/knowledge.yaml`
+- 交付契约：`docs/ack/delivery.yaml`
 - 覆盖层文件：`docs/ack/project.md`
 
 ## 稳定规范（引用，不重复）
@@ -25,6 +26,7 @@
 - 优化方法（验收信号、三轮策略）：`references/optimization-method.md`
 - 派发 prompt 模板：`references/prompt-templates.md`
 - Orca 编排命令：`references/orca-adapter.md`
+- 验证后交付：`references/delivery.md`
 
 ## Worker 路由
 
@@ -52,6 +54,7 @@
 | `.env`、`config/local.*` | Read-only | Read-only | Read-only | 本地私有配置 |
 | `tasks.yaml` | R/W | Read-only | Read-only | 只有 Coordinator 写 |
 | `knowledge.yaml` | R/W | Read-only | Read-only | 只有 Coordinator 写；Developer/Test 通过回报提名或验证 |
+| `delivery.yaml` | 仅显式维护时 R/W | Read-only | Read-only | 项目交付能力，不是执行授权 |
 
 ## 命令
 
@@ -75,8 +78,9 @@ curl -s -X POST http://localhost:5173/api/fix/preview -d @fixtures/preview.json
 ID 对应仓库内相对 path 和结构化 args。知识正文不保存或自动执行自由 shell 命令。
 执行时只把检查 ID 交给 Skill 的 `scripts/run_verification.py`，不直接拼接
 path/args。
-项目状态校验由 `/ack` 使用 Skill 自带的 `scripts/validate_tasks.py` 和
-`scripts/validate_knowledge.py` 执行。
+项目状态校验由 `/ack` 使用 Skill 自带的 `scripts/validate_tasks.py`、
+`scripts/validate_knowledge.py` 和 `scripts/validate_delivery.py` 执行。
+交付机器入口以 `delivery.yaml` 为准，本覆盖层不维护第二套发布或部署命令。
 
 ## 硬规则（其余见 references/）
 
@@ -93,5 +97,7 @@ path/args。
   `candidate` 不派发，知识库不全量注入。
 - Developer 回报 `knowledgeApplied` 与 `knowledgeCandidates`，Test 回报
   `knowledgeChecks`；关键约束应继续下沉到测试、lint、CI 或正式规范。
+- 交付只在任务 `verified` 后运行；默认 profile 停在 `review_ready`。stable 发布与
+  production 部署保留显式 approval，配置变更只影响下一次 run。
 - 每个任务最多派发 3 轮，仍不过标记 `leftover` 并继续。
-- 不提交或推送，除非用户明确要求。
+- 不提交、推送、发布或部署，除非用户确认的 ACK 任务或 delivery profile 明确包含。

skills/ack/examples/tasks.example.yaml

@@ -3,7 +3,7 @@
 version: 1
 updatedAt: "2026-07-06T09:40:00+08:00"
 source: "Coordinator (PM) Agent"
-ackVersion: "0.10.0"
+ackVersion: "0.11.0"
 project:
   name: "notes-web"
   repoPath: "/home/dev/notes-web"
@@ -11,6 +11,7 @@ project:
   devWorktree: "/home/dev/notes-web-wt/fix-preview"
   overlayFile: "docs/ack/project.md"
   knowledgeFile: "docs/ack/knowledge.yaml"
+  deliveryFile: "docs/ack/delivery.yaml"
   orchestration:
     profileVersion: 1
     mode: "manual"
@@ -70,6 +71,7 @@ project:
       developerUpgraded: "codex-dev-strong"
 
 workerReceipts: []
+deliveryRuns: []
 
 summary:
   verified: ["BUG-002"]