@mc-and-his-agents/loom-installer 0.1.27 → 0.1.28

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mc-and-his-agents/loom-installer",
-  "version": "0.1.27",
+  "version": "0.1.28",
   "description": "Node installer for Loom plugin and single-skill installation surfaces.",
   "type": "module",
   "bin": {

package/payload/manifest.json

@@ -2,9 +2,9 @@
   "schema_version": "loom-installer-payload/v1",
   "loom_version": "0.4.0",
   "source_repository": "https://github.com/MC-and-his-Agents/Loom",
-  "source_commit": "72c484aa09e0c62361ba56aeeec319851468d5e8",
+  "source_commit": "da62e14fb59e95ab0c8b862d4d39f884d8c44ac7",
   "source_ref": "main",
-  "built_at": "2026-04-27T00:39:19+08:00",
+  "built_at": "2026-04-27T00:52:37+08:00",
   "runtime": {
     "python_minimum": "3.10",
     "python_recommended": "3.11+"
@@ -408,8 +408,13 @@
     },
     {
       "path": "plugin/loom/skills/shared/references/adoption/deep-existing-repo-default.md",
-      "bytes": 2450,
-      "sha256": "0dc20308064a08a96e4f51b028967b43d3fcf93232f10b0b2d486ff13edcaf35"
+      "bytes": 3365,
+      "sha256": "a1a9f4e9d97db6a0b0e0b6f8c097b64b6e5122e35a08b1759fa343ffca667a0c"
+    },
+    {
+      "path": "plugin/loom/skills/shared/references/adoption/external-runtime-companion-contract.md",
+      "bytes": 3860,
+      "sha256": "814773c73c875472b6c5dc5e078268f5266bec105e14ca4bb94da9a55db978ac"
     },
     {
       "path": "plugin/loom/skills/shared/references/adoption/github-profile-upgrade.md",
@@ -563,8 +568,8 @@
     },
     {
       "path": "plugin/loom/skills/shared/references/harness/runtime-state.md",
-      "bytes": 2508,
-      "sha256": "a28c960a9be6cbf77c6276204d96e83dff99b334dfcedbda31068ea8876fc3f3"
+      "bytes": 3416,
+      "sha256": "b53b5ce340f54dd25f15d68f5a637d8ea55ca8420d843031b3ed61cd1be43593"
     },
     {
       "path": "plugin/loom/skills/shared/references/harness/status-surface-contract.md",
@@ -628,8 +633,8 @@
     },
     {
       "path": "plugin/loom/skills/shared/scripts/loom_check.py",
-      "bytes": 296087,
-      "sha256": "1acd2461b1150b9d4c328571c849556e1b3b36dd9595254643aa046367b66009"
+      "bytes": 297968,
+      "sha256": "8a5ee386532ac7772563ced89cb644ffb1eb00087d7c77ee1a661de88ce717b3"
     },
     {
       "path": "plugin/loom/skills/shared/scripts/loom_flow.py",
@@ -993,8 +998,13 @@
     },
     {
       "path": "skills/loom-adopt/.loom-runtime/shared/references/adoption/deep-existing-repo-default.md",
-      "bytes": 2450,
-      "sha256": "0dc20308064a08a96e4f51b028967b43d3fcf93232f10b0b2d486ff13edcaf35"
+      "bytes": 3365,
+      "sha256": "a1a9f4e9d97db6a0b0e0b6f8c097b64b6e5122e35a08b1759fa343ffca667a0c"
+    },
+    {
+      "path": "skills/loom-adopt/.loom-runtime/shared/references/adoption/external-runtime-companion-contract.md",
+      "bytes": 3860,
+      "sha256": "814773c73c875472b6c5dc5e078268f5266bec105e14ca4bb94da9a55db978ac"
     },
     {
       "path": "skills/loom-adopt/.loom-runtime/shared/references/adoption/github-profile-upgrade.md",
@@ -1148,8 +1158,8 @@
     },
     {
       "path": "skills/loom-adopt/.loom-runtime/shared/references/harness/runtime-state.md",
-      "bytes": 2508,
-      "sha256": "a28c960a9be6cbf77c6276204d96e83dff99b334dfcedbda31068ea8876fc3f3"
+      "bytes": 3416,
+      "sha256": "b53b5ce340f54dd25f15d68f5a637d8ea55ca8420d843031b3ed61cd1be43593"
     },
     {
       "path": "skills/loom-adopt/.loom-runtime/shared/references/harness/status-surface-contract.md",
@@ -1213,8 +1223,8 @@
     },
     {
       "path": "skills/loom-adopt/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 296087,
-      "sha256": "1acd2461b1150b9d4c328571c849556e1b3b36dd9595254643aa046367b66009"
+      "bytes": 297968,
+      "sha256": "8a5ee386532ac7772563ced89cb644ffb1eb00087d7c77ee1a661de88ce717b3"
     },
     {
       "path": "skills/loom-adopt/.loom-runtime/shared/scripts/loom_flow.py",
@@ -1608,8 +1618,13 @@
     },
     {
       "path": "skills/loom-handoff/.loom-runtime/shared/references/adoption/deep-existing-repo-default.md",
-      "bytes": 2450,
-      "sha256": "0dc20308064a08a96e4f51b028967b43d3fcf93232f10b0b2d486ff13edcaf35"
+      "bytes": 3365,
+      "sha256": "a1a9f4e9d97db6a0b0e0b6f8c097b64b6e5122e35a08b1759fa343ffca667a0c"
+    },
+    {
+      "path": "skills/loom-handoff/.loom-runtime/shared/references/adoption/external-runtime-companion-contract.md",
+      "bytes": 3860,
+      "sha256": "814773c73c875472b6c5dc5e078268f5266bec105e14ca4bb94da9a55db978ac"
     },
     {
       "path": "skills/loom-handoff/.loom-runtime/shared/references/adoption/github-profile-upgrade.md",
@@ -1763,8 +1778,8 @@
     },
     {
       "path": "skills/loom-handoff/.loom-runtime/shared/references/harness/runtime-state.md",
-      "bytes": 2508,
-      "sha256": "a28c960a9be6cbf77c6276204d96e83dff99b334dfcedbda31068ea8876fc3f3"
+      "bytes": 3416,
+      "sha256": "b53b5ce340f54dd25f15d68f5a637d8ea55ca8420d843031b3ed61cd1be43593"
     },
     {
       "path": "skills/loom-handoff/.loom-runtime/shared/references/harness/status-surface-contract.md",
@@ -1828,8 +1843,8 @@
     },
     {
       "path": "skills/loom-handoff/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 296087,
-      "sha256": "1acd2461b1150b9d4c328571c849556e1b3b36dd9595254643aa046367b66009"
+      "bytes": 297968,
+      "sha256": "8a5ee386532ac7772563ced89cb644ffb1eb00087d7c77ee1a661de88ce717b3"
     },
     {
       "path": "skills/loom-handoff/.loom-runtime/shared/scripts/loom_flow.py",
@@ -2223,8 +2238,13 @@
     },
     {
       "path": "skills/loom-init/.loom-runtime/shared/references/adoption/deep-existing-repo-default.md",
-      "bytes": 2450,
-      "sha256": "0dc20308064a08a96e4f51b028967b43d3fcf93232f10b0b2d486ff13edcaf35"
+      "bytes": 3365,
+      "sha256": "a1a9f4e9d97db6a0b0e0b6f8c097b64b6e5122e35a08b1759fa343ffca667a0c"
+    },
+    {
+      "path": "skills/loom-init/.loom-runtime/shared/references/adoption/external-runtime-companion-contract.md",
+      "bytes": 3860,
+      "sha256": "814773c73c875472b6c5dc5e078268f5266bec105e14ca4bb94da9a55db978ac"
     },
     {
       "path": "skills/loom-init/.loom-runtime/shared/references/adoption/github-profile-upgrade.md",
@@ -2378,8 +2398,8 @@
     },
     {
       "path": "skills/loom-init/.loom-runtime/shared/references/harness/runtime-state.md",
-      "bytes": 2508,
-      "sha256": "a28c960a9be6cbf77c6276204d96e83dff99b334dfcedbda31068ea8876fc3f3"
+      "bytes": 3416,
+      "sha256": "b53b5ce340f54dd25f15d68f5a637d8ea55ca8420d843031b3ed61cd1be43593"
     },
     {
       "path": "skills/loom-init/.loom-runtime/shared/references/harness/status-surface-contract.md",
@@ -2443,8 +2463,8 @@
     },
     {
       "path": "skills/loom-init/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 296087,
-      "sha256": "1acd2461b1150b9d4c328571c849556e1b3b36dd9595254643aa046367b66009"
+      "bytes": 297968,
+      "sha256": "8a5ee386532ac7772563ced89cb644ffb1eb00087d7c77ee1a661de88ce717b3"
     },
     {
       "path": "skills/loom-init/.loom-runtime/shared/scripts/loom_flow.py",
@@ -2843,8 +2863,13 @@
     },
     {
       "path": "skills/loom-merge-ready/.loom-runtime/shared/references/adoption/deep-existing-repo-default.md",
-      "bytes": 2450,
-      "sha256": "0dc20308064a08a96e4f51b028967b43d3fcf93232f10b0b2d486ff13edcaf35"
+      "bytes": 3365,
+      "sha256": "a1a9f4e9d97db6a0b0e0b6f8c097b64b6e5122e35a08b1759fa343ffca667a0c"
+    },
+    {
+      "path": "skills/loom-merge-ready/.loom-runtime/shared/references/adoption/external-runtime-companion-contract.md",
+      "bytes": 3860,
+      "sha256": "814773c73c875472b6c5dc5e078268f5266bec105e14ca4bb94da9a55db978ac"
     },
     {
       "path": "skills/loom-merge-ready/.loom-runtime/shared/references/adoption/github-profile-upgrade.md",
@@ -2998,8 +3023,8 @@
     },
     {
       "path": "skills/loom-merge-ready/.loom-runtime/shared/references/harness/runtime-state.md",
-      "bytes": 2508,
-      "sha256": "a28c960a9be6cbf77c6276204d96e83dff99b334dfcedbda31068ea8876fc3f3"
+      "bytes": 3416,
+      "sha256": "b53b5ce340f54dd25f15d68f5a637d8ea55ca8420d843031b3ed61cd1be43593"
     },
     {
       "path": "skills/loom-merge-ready/.loom-runtime/shared/references/harness/status-surface-contract.md",
@@ -3063,8 +3088,8 @@
     },
     {
       "path": "skills/loom-merge-ready/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 296087,
-      "sha256": "1acd2461b1150b9d4c328571c849556e1b3b36dd9595254643aa046367b66009"
+      "bytes": 297968,
+      "sha256": "8a5ee386532ac7772563ced89cb644ffb1eb00087d7c77ee1a661de88ce717b3"
     },
     {
       "path": "skills/loom-merge-ready/.loom-runtime/shared/scripts/loom_flow.py",
@@ -3458,8 +3483,13 @@
     },
     {
       "path": "skills/loom-pre-review/.loom-runtime/shared/references/adoption/deep-existing-repo-default.md",
-      "bytes": 2450,
-      "sha256": "0dc20308064a08a96e4f51b028967b43d3fcf93232f10b0b2d486ff13edcaf35"
+      "bytes": 3365,
+      "sha256": "a1a9f4e9d97db6a0b0e0b6f8c097b64b6e5122e35a08b1759fa343ffca667a0c"
+    },
+    {
+      "path": "skills/loom-pre-review/.loom-runtime/shared/references/adoption/external-runtime-companion-contract.md",
+      "bytes": 3860,
+      "sha256": "814773c73c875472b6c5dc5e078268f5266bec105e14ca4bb94da9a55db978ac"
     },
     {
       "path": "skills/loom-pre-review/.loom-runtime/shared/references/adoption/github-profile-upgrade.md",
@@ -3613,8 +3643,8 @@
     },
     {
       "path": "skills/loom-pre-review/.loom-runtime/shared/references/harness/runtime-state.md",
-      "bytes": 2508,
-      "sha256": "a28c960a9be6cbf77c6276204d96e83dff99b334dfcedbda31068ea8876fc3f3"
+      "bytes": 3416,
+      "sha256": "b53b5ce340f54dd25f15d68f5a637d8ea55ca8420d843031b3ed61cd1be43593"
     },
     {
       "path": "skills/loom-pre-review/.loom-runtime/shared/references/harness/status-surface-contract.md",
@@ -3678,8 +3708,8 @@
     },
     {
       "path": "skills/loom-pre-review/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 296087,
-      "sha256": "1acd2461b1150b9d4c328571c849556e1b3b36dd9595254643aa046367b66009"
+      "bytes": 297968,
+      "sha256": "8a5ee386532ac7772563ced89cb644ffb1eb00087d7c77ee1a661de88ce717b3"
     },
     {
       "path": "skills/loom-pre-review/.loom-runtime/shared/scripts/loom_flow.py",
@@ -4073,8 +4103,13 @@
     },
     {
       "path": "skills/loom-resume/.loom-runtime/shared/references/adoption/deep-existing-repo-default.md",
-      "bytes": 2450,
-      "sha256": "0dc20308064a08a96e4f51b028967b43d3fcf93232f10b0b2d486ff13edcaf35"
+      "bytes": 3365,
+      "sha256": "a1a9f4e9d97db6a0b0e0b6f8c097b64b6e5122e35a08b1759fa343ffca667a0c"
+    },
+    {
+      "path": "skills/loom-resume/.loom-runtime/shared/references/adoption/external-runtime-companion-contract.md",
+      "bytes": 3860,
+      "sha256": "814773c73c875472b6c5dc5e078268f5266bec105e14ca4bb94da9a55db978ac"
     },
     {
       "path": "skills/loom-resume/.loom-runtime/shared/references/adoption/github-profile-upgrade.md",
@@ -4228,8 +4263,8 @@
     },
     {
       "path": "skills/loom-resume/.loom-runtime/shared/references/harness/runtime-state.md",
-      "bytes": 2508,
-      "sha256": "a28c960a9be6cbf77c6276204d96e83dff99b334dfcedbda31068ea8876fc3f3"
+      "bytes": 3416,
+      "sha256": "b53b5ce340f54dd25f15d68f5a637d8ea55ca8420d843031b3ed61cd1be43593"
     },
     {
       "path": "skills/loom-resume/.loom-runtime/shared/references/harness/status-surface-contract.md",
@@ -4293,8 +4328,8 @@
     },
     {
       "path": "skills/loom-resume/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 296087,
-      "sha256": "1acd2461b1150b9d4c328571c849556e1b3b36dd9595254643aa046367b66009"
+      "bytes": 297968,
+      "sha256": "8a5ee386532ac7772563ced89cb644ffb1eb00087d7c77ee1a661de88ce717b3"
     },
     {
       "path": "skills/loom-resume/.loom-runtime/shared/scripts/loom_flow.py",
@@ -4688,8 +4723,13 @@
     },
     {
       "path": "skills/loom-retire/.loom-runtime/shared/references/adoption/deep-existing-repo-default.md",
-      "bytes": 2450,
-      "sha256": "0dc20308064a08a96e4f51b028967b43d3fcf93232f10b0b2d486ff13edcaf35"
+      "bytes": 3365,
+      "sha256": "a1a9f4e9d97db6a0b0e0b6f8c097b64b6e5122e35a08b1759fa343ffca667a0c"
+    },
+    {
+      "path": "skills/loom-retire/.loom-runtime/shared/references/adoption/external-runtime-companion-contract.md",
+      "bytes": 3860,
+      "sha256": "814773c73c875472b6c5dc5e078268f5266bec105e14ca4bb94da9a55db978ac"
     },
     {
       "path": "skills/loom-retire/.loom-runtime/shared/references/adoption/github-profile-upgrade.md",
@@ -4843,8 +4883,8 @@
     },
     {
       "path": "skills/loom-retire/.loom-runtime/shared/references/harness/runtime-state.md",
-      "bytes": 2508,
-      "sha256": "a28c960a9be6cbf77c6276204d96e83dff99b334dfcedbda31068ea8876fc3f3"
+      "bytes": 3416,
+      "sha256": "b53b5ce340f54dd25f15d68f5a637d8ea55ca8420d843031b3ed61cd1be43593"
     },
     {
       "path": "skills/loom-retire/.loom-runtime/shared/references/harness/status-surface-contract.md",
@@ -4908,8 +4948,8 @@
     },
     {
       "path": "skills/loom-retire/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 296087,
-      "sha256": "1acd2461b1150b9d4c328571c849556e1b3b36dd9595254643aa046367b66009"
+      "bytes": 297968,
+      "sha256": "8a5ee386532ac7772563ced89cb644ffb1eb00087d7c77ee1a661de88ce717b3"
     },
     {
       "path": "skills/loom-retire/.loom-runtime/shared/scripts/loom_flow.py",
@@ -5303,8 +5343,13 @@
     },
     {
       "path": "skills/loom-review/.loom-runtime/shared/references/adoption/deep-existing-repo-default.md",
-      "bytes": 2450,
-      "sha256": "0dc20308064a08a96e4f51b028967b43d3fcf93232f10b0b2d486ff13edcaf35"
+      "bytes": 3365,
+      "sha256": "a1a9f4e9d97db6a0b0e0b6f8c097b64b6e5122e35a08b1759fa343ffca667a0c"
+    },
+    {
+      "path": "skills/loom-review/.loom-runtime/shared/references/adoption/external-runtime-companion-contract.md",
+      "bytes": 3860,
+      "sha256": "814773c73c875472b6c5dc5e078268f5266bec105e14ca4bb94da9a55db978ac"
     },
     {
       "path": "skills/loom-review/.loom-runtime/shared/references/adoption/github-profile-upgrade.md",
@@ -5458,8 +5503,8 @@
     },
     {
       "path": "skills/loom-review/.loom-runtime/shared/references/harness/runtime-state.md",
-      "bytes": 2508,
-      "sha256": "a28c960a9be6cbf77c6276204d96e83dff99b334dfcedbda31068ea8876fc3f3"
+      "bytes": 3416,
+      "sha256": "b53b5ce340f54dd25f15d68f5a637d8ea55ca8420d843031b3ed61cd1be43593"
     },
     {
       "path": "skills/loom-review/.loom-runtime/shared/references/harness/status-surface-contract.md",
@@ -5523,8 +5568,8 @@
     },
     {
       "path": "skills/loom-review/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 296087,
-      "sha256": "1acd2461b1150b9d4c328571c849556e1b3b36dd9595254643aa046367b66009"
+      "bytes": 297968,
+      "sha256": "8a5ee386532ac7772563ced89cb644ffb1eb00087d7c77ee1a661de88ce717b3"
     },
     {
       "path": "skills/loom-review/.loom-runtime/shared/scripts/loom_flow.py",
@@ -5918,8 +5963,13 @@
     },
     {
       "path": "skills/loom-spec-review/.loom-runtime/shared/references/adoption/deep-existing-repo-default.md",
-      "bytes": 2450,
-      "sha256": "0dc20308064a08a96e4f51b028967b43d3fcf93232f10b0b2d486ff13edcaf35"
+      "bytes": 3365,
+      "sha256": "a1a9f4e9d97db6a0b0e0b6f8c097b64b6e5122e35a08b1759fa343ffca667a0c"
+    },
+    {
+      "path": "skills/loom-spec-review/.loom-runtime/shared/references/adoption/external-runtime-companion-contract.md",
+      "bytes": 3860,
+      "sha256": "814773c73c875472b6c5dc5e078268f5266bec105e14ca4bb94da9a55db978ac"
     },
     {
       "path": "skills/loom-spec-review/.loom-runtime/shared/references/adoption/github-profile-upgrade.md",
@@ -6073,8 +6123,8 @@
     },
     {
       "path": "skills/loom-spec-review/.loom-runtime/shared/references/harness/runtime-state.md",
-      "bytes": 2508,
-      "sha256": "a28c960a9be6cbf77c6276204d96e83dff99b334dfcedbda31068ea8876fc3f3"
+      "bytes": 3416,
+      "sha256": "b53b5ce340f54dd25f15d68f5a637d8ea55ca8420d843031b3ed61cd1be43593"
     },
     {
       "path": "skills/loom-spec-review/.loom-runtime/shared/references/harness/status-surface-contract.md",
@@ -6138,8 +6188,8 @@
     },
     {
       "path": "skills/loom-spec-review/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 296087,
-      "sha256": "1acd2461b1150b9d4c328571c849556e1b3b36dd9595254643aa046367b66009"
+      "bytes": 297968,
+      "sha256": "8a5ee386532ac7772563ced89cb644ffb1eb00087d7c77ee1a661de88ce717b3"
     },
     {
       "path": "skills/loom-spec-review/.loom-runtime/shared/scripts/loom_flow.py",

package/payload/plugin/loom/skills/shared/references/adoption/deep-existing-repo-default.md

@@ -2,14 +2,14 @@
 
 本文件定义 Loom 面向成熟既有治理重仓的默认接入策略。
 
-它不替代 `lightweight-retrofit-default`，而是作为 `complex-existing` 下的保守 attach path，服务已经拥有稳定根规则、统一验证入口与沉重 repo-specific gates 的仓库。
+它不替代 [lightweight-retrofit-default.md](./lightweight-retrofit-default.md)，而是作为 `complex-existing` 下的保守 attach path，服务已经拥有稳定根规则、统一验证入口与沉重 repo-specific gates 的仓库。
 
 ## 1. 适用场景
 
 当目标仓库同时满足以下条件时，默认采用本策略：
 
-- 属于既有仓库，且 `loom-init` 判断仍为 `复杂既有仓库`
-- 已有清晰的根级边界文档
+- 属于既有仓库，且 `loom-init` 判断仍为 `complex-existing`
+- 已有清晰的根级边界文档，例如 `AGENTS.md`、`WORKFLOW.md` 或等价根规则
 - 已有统一的仓库级验证入口
 - 已出现 `merge_review_semantic_overload`
 - 当前复杂度主要来自 review / guardian 负载、repo-specific gates、retained host actions 或 repo-native carriers，而不是 Loom 缺少 recovery/status carriers
@@ -44,6 +44,8 @@
 - 保留 repo-native carriers
 - 只追加 Loom-owned attach metadata 与 companion 入口
 
+换句话说，Loom 这一步接管的是入口与读面，不是宿主动作底层实现。
+
 ## 5. 默认不装配
 
 第一轮默认不装配：
@@ -60,5 +62,18 @@
 
 - 当前仓库需要 Loom-owned recovery carrier 承接多轮执行停点
 - repo-native carriers 无法稳定承接 recovery / review / closeout 真相
-- companion 之外还需要 Loom-owned `status control plane` 承接统一读面
+- companion 之外还需要 Loom-owned status surface 承接统一读面
 - repo-local attach 入口已经稳定，但下一轮需要 typed machine contract、interop 或 shadow parity
+
+## 7. Attach-only 之后的 external runtime 路径
+
+成熟既有仓库第一轮可以继续提交 vendored `.loom/bin`，因为它提供可审计 runtime provenance。
+
+只有在以下条件满足后，才应考虑 de-vendor：
+
+- `.loom/companion` 与 `interop.json` 已稳定
+- `runtime-state`、`governance-profile status`、`runtime-parity validate`、`shadow-parity` 都能读取同一治理载体
+- external runtime locator 已按 [external-runtime-companion-contract.md](./external-runtime-companion-contract.md) 版本化声明
+- rollback 能回到 vendored `.loom/bin` 或重新 bootstrap
+
+de-vendor 不得删除 repo-owned residue，也不得替代 guardian、integration contract、release / sprint 等仓库私有规则。

package/payload/plugin/loom/skills/shared/references/adoption/external-runtime-companion-contract.md

@@ -0,0 +1,110 @@
+# External Runtime Companion Contract
+
+本文定义从 vendored `.loom/bin` runtime 迁移到 versioned external Loom runtime 的路径。
+
+本轮只冻结合同和迁移纪律，不要求任何 adopted repo 立即 de-vendor。
+
+## 1. 目标
+
+external-runtime 的目标是让成熟 adopted repo 最终可以：
+
+- 保留 `.loom/companion`、status、work item、review、shadow evidence 等仓内治理载体
+- 停止长期提交 vendored `.loom/bin/*` runtime 文件
+- 通过版本化 Loom runtime locator 执行同一组 Loom 命令
+- 在迁移失败时可回滚到 vendored `.loom/bin` carrier
+
+## 2. 当前默认
+
+当前稳定默认仍是 vendored `.loom/bin` runtime。
+
+原因：
+
+- `loom_init verify` 已经要求 `.loom/bin/*` 与 `.loom/bootstrap/manifest.json` 一致
+- manifest 中的 runtime artifact `sha256` 是当前 fail-closed trust boundary
+- Syvert-style strong adoption 仍需要本地可审计 runtime provenance
+
+因此，external-runtime 只是一条显式迁移路径，不是当前默认安装形态。
+
+## 3. Companion 保留面
+
+迁移到 external-runtime 时，以下仓内载体必须保持稳定，不得因为 runtime locator 改变而重写语义：
+
+- `.loom/companion/manifest.json`
+- `.loom/companion/repo-interface.json`
+- `.loom/companion/interop.json`
+- `.loom/status/current.md`
+- `.loom/work-items/*`
+- `.loom/progress/*`
+- `.loom/reviews/*`
+- `.loom/shadow/*`
+
+这些文件继续是 repo-local governance carrier。external runtime 只能替换执行入口，不能替代仓内治理真相。
+
+## 4. External runtime locator
+
+external-runtime companion 必须显式声明 runtime locator，而不是依赖环境变量猜测。
+
+最小字段：
+
+```json
+{
+  "schema_version": "loom-external-runtime/v1",
+  "runtime_locator": "loom://github/MC-and-his-Agents/Loom@v1.3",
+  "runtime_version": "v1.3",
+  "fallback_runtime": ".loom/bin",
+  "companion_manifest": ".loom/companion/manifest.json",
+  "interop_contract": ".loom/companion/interop.json",
+  "rollback_mode": "vendored-runtime"
+}
+```
+
+稳定约束：
+
+- `runtime_locator` 必须是版本化 locator，不能是浮动 `main`
+- `fallback_runtime` 必须指向可恢复的 vendored `.loom/bin` 或明确声明需要 rebootstrap
+- `companion_manifest` 与 `interop_contract` 必须继续指向仓内相对路径
+- external-runtime 不得通过 `LOOM_SOURCE_REPO_ROOT` 覆盖 bootstrapped target runtime 的判定
+
+## 5. Migration sequence
+
+推荐迁移顺序：
+
+1. 保持 vendored `.loom/bin`，先确认 runtime provenance hash 全部通过
+2. 记录 external runtime locator 与版本
+3. 在 rehearsal 中运行：
+   - `runtime-state`
+   - `governance-profile status`
+   - `runtime-parity validate`
+   - `shadow-parity`
+   - `shadow-parity --blocking`，仅限显式 strong profile smoke
+4. 确认 `.loom/companion`、status、work item、review、shadow evidence 均未因 runtime locator 改变而漂移
+5. 只在以上检查通过后删除或停止提交 vendored `.loom/bin`
+
+## 6. Rollback
+
+任一条件失败时必须回滚到 vendored runtime 或 rebootstrap：
+
+- external runtime locator 不可解析
+- runtime version 与期望不一致
+- `.loom/companion` 或 `interop.json` 不可读
+- shadow evidence source hash 漂移
+- active item、review head binding 或 metadata parsing 出现不一致
+
+Rollback 操作必须：
+
+- 保留 evidence
+- 恢复 `.loom/bin` 或重新运行 `loom_init bootstrap --write --force --verify`
+- 回到 `advisory` gate rollout mode
+- 重新运行 adversarial adoption checks 后才允许恢复 blocking 消费
+
+## 7. 边界
+
+external-runtime 迁移不改变：
+
+- repo companion 的 repo-specific residue ownership
+- repo interop 的只读 locator 语义
+- host action ownership
+- review / merge-ready / closeout 的 gate 语义
+- shadow parity 默认 validation-only 的边界
+
+它只改变 Loom runtime 的执行来源。

package/payload/plugin/loom/skills/shared/references/harness/runtime-state.md

@@ -101,3 +101,17 @@
   - 回答仓库 Loom 装配态与治理载体/宿主控制面的落位
 
 这三者不得互相伪装成别名。
+
+## 7. Carrier transition invariants
+
+从 vendored `.loom/bin` runtime 迁移到 external runtime 时，`runtime-state` 必须保持 fail-closed：
+
+- bootstrapped target runtime 优先由当前入口路径和 `.loom/bootstrap/manifest.json` 判定
+- 外部 `LOOM_SOURCE_REPO_ROOT` 不得抢先改判 bootstrapped target runtime
+- `.loom/bootstrap/manifest.json` 中声明的 `.loom/bin/*` artifact 必须继续有 `sha256`
+- 若 vendored runtime 被删除，external runtime 必须提供 versioned runtime locator 和 rollback path
+- external runtime rehearsal 不得改写 `.loom/companion`、status、work item、review 或 shadow evidence 的 truth
+
+当前默认 carrier 仍是 vendored `.loom/bin`。external runtime 只能作为显式迁移目标，不能通过环境变量隐式启用。
+
+迁移合同见 [external-runtime-companion-contract.md](../adoption/external-runtime-companion-contract.md)。

package/payload/plugin/loom/skills/shared/scripts/loom_check.py

@@ -98,6 +98,7 @@ CORE_DOCS = (
     "docs/evidence/validations/validation-adoption-maturity-required-fields.md",
     "docs/evidence/validations/validation-skills-consume-maturity-upgrade-path.md",
     "docs/evidence/validations/validation-adoption-gate-rollout.md",
+    "docs/evidence/validations/validation-external-runtime-devendor-migration.md",
     "docs/evidence/validations/validation-github-profile-binding-orchestration.md",
     "docs/evidence/validations/validation-github-profile-drift-reconciliation.md",
     "docs/evidence/validations/validation-github-profile-graphql-budget-guard.md",
@@ -111,6 +112,7 @@ CORE_DOCS = (
     "docs/adoption/routing-and-checkpoints.md",
     "docs/adoption/github-profile.md",
     "docs/adoption/github-profile-upgrade.md",
+    "docs/adoption/external-runtime-companion-contract.md",
     "docs/adoption/lightweight-retrofit-default.md",
     "docs/adoption/repo-companion-contract.md",
     "docs/adoption/repo-interop-contract.md",
@@ -6028,6 +6030,53 @@ def check_repo_interop_contracts(root: Path) -> list[Failure]:
     return failures
 
 
+def check_external_runtime_devendor_contract(root: Path) -> list[Failure]:
+    failures: list[Failure] = []
+    required_anchors = {
+        "docs/adoption/external-runtime-companion-contract.md": [
+            "vendored `.loom/bin`",
+            "runtime_locator",
+            "versioned external Loom runtime",
+            "rollback",
+            ".loom/companion/interop.json",
+        ],
+        "docs/adoption/repo-interop-contract.md": [
+            "external-runtime",
+            "de-vendor",
+            "runtime locator",
+            "interop",
+        ],
+        "docs/adoption/repo-companion-contract.md": [
+            "external-runtime",
+            "runtime locator",
+            "repo-interface.json",
+        ],
+        "skills/shared/references/harness/runtime-state.md": [
+            "Carrier transition invariants",
+            "LOOM_SOURCE_REPO_ROOT",
+            "external runtime",
+            "vendored `.loom/bin`",
+        ],
+        "docs/evidence/validations/validation-external-runtime-devendor-migration.md": [
+            "external-runtime",
+            "de-vendor",
+            "rollback",
+            "advisory",
+        ],
+    }
+    for relative, anchors in required_anchors.items():
+        path = root / relative
+        try:
+            text = path.read_text(encoding="utf-8")
+        except OSError as exc:
+            failures.append(Failure("external-runtime-devendor", f"`{relative}` is unreadable: {exc}"))
+            continue
+        for anchor in anchors:
+            if anchor not in text:
+                failures.append(Failure("external-runtime-devendor", f"`{relative}` must mention `{anchor}`"))
+    return failures
+
+
 def check_node_installer(root: Path) -> list[Failure]:
     category = "node-installer"
     failures: list[Failure] = []
@@ -6139,6 +6188,7 @@ def collect_failures(root: Path) -> list[Failure]:
     failures.extend(check_daily_execution_cli(root))
     failures.extend(check_repo_companion_interface_contracts(root))
     failures.extend(check_repo_interop_contracts(root))
+    failures.extend(check_external_runtime_devendor_contract(root))
     failures.extend(check_node_installer(root))
     failures.extend(check_generated_artifacts_untracked(root))
     failures.extend(check_github_cli_budget(root))