release-skill 0.4.2 → 0.5.0

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "release-skill",
       "source": "./",
-      "version": "0.4.2",
+      "version": "0.5.0",
       "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
       "author": {
         "name": "广州市风荷科技有限公司"

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.4.2",
+  "version": "0.5.0",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codebuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.4.2",
+  "version": "0.5.0",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.4.2",
+  "version": "0.5.0",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"
@@ -19,7 +19,7 @@
     ],
     "defaultPrompt": [
       "Assess this project for release readiness.",
-      "Prepare a release plan for version 0.4.2.",
+      "Prepare a release plan for version 0.5.0.",
       "Help me understand the release workflow."
     ]
   }

package/.kimi-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.4.2",
+  "version": "0.5.0",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.5.0 locale=en baseline=sha256:e59bef4bd7bc6e0809d1f415d7ff3d342e45a7e77075f66d6ffa48cfd9b71932 -->
+## [0.5.0] - 2026-08-16
+
+v0.5.0 adopts the released Skill Family Foundation 0.4.0 packages (skill-family-contracts / skill-family-harness-node) for digest computation, atomic writes, contained file reads, and project locking; migrates the project lock domain to a single-file token lock with fail-closed legacy detection; hardens the online assess npm check against fail-open; and documents the hooks authorization contract as config-time authorization.
+
+### Added
+
+- **Negative test coverage**: 12 additional tests covering exclusive publication, token-lock migration, and the assess npm-check behavior.
+
+### Changed
+
+- **Foundation adoption**: digest computation, atomic writes, contained-path reads and project locking now delegate to the published `skill-family-contracts@0.4.0` / `skill-family-harness-node@0.4.0` packages instead of local implementations; dependencies bumped from 0.3.0 to 0.4.0.
+- **Token lock domain**: project locks migrated from a directory-based domain to a single `.release-skill/lock` file (0600, token record). Legacy directory-form locks are detected and fail closed with `LOCK_MIGRATION_REQUIRED`; no automatic conversion or deletion is performed.
+- **Exclusive plan/run publication**: immutable plan and run records are published via `publishFileExclusive` — identical bytes are idempotent, divergent bytes fail with `GATE_FAILED`.
+- **Assess npm check semantics**: the online `assess` npm check no longer treats every registry error as version-not-found; only E404/ETARGET mean a missing version, other failures surface as an `NPM_VERSION_CHECK_FAILED` warning.
+- **Hooks authorization contract**: release-prepare/release-help now document the explicit contract that configuring a hook in project configuration IS the authorization (hooks are arbitrary local processes with no sandbox, no filesystem/network isolation, and no pre-trigger confirmation point); restoring a mandatory pre-trigger confirmation gate is a future hardening item.
+- **Audit-scope ruling**: the bundled-family marketplace configuration is recorded as not applicable to the `release_artifact` target type (G3 target-side T4 ruling); T3/T5/T6 deferred to independent tasks.
+- **Plan schema**: production plans carry the resolved codebuddy marketplace coordinates so approval and publish review the exact marketplace target.
+
+### Fixed
+
+- **Configurable CodeBuddy marketplace**: codebuddy-plugin distributions accept `marketplace` and `marketplaceSource` in project configuration, and prepare threads both values into the consumer install action instead of assuming a fixed marketplace.
+- **Assess fail-open**: an online `assess` no longer silently reports no gaps when the npm registry check fails for reasons other than a missing version.
+<!-- release-skill:changelog:end version=0.5.0 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.4.2 locale=en baseline=sha256:b8676f90eb68c93e40f84ff16de18a8c472e6a06e321bcc25895799e9e6f3896 -->
 ## [0.4.2] - 2026-08-12
 

package/INSTALL.md

@@ -2,7 +2,7 @@
 
 [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.4.2 -->
+<!-- release-skill:release-version: 0.5.0 -->
 ## Prerequisites
 
 - Node.js 22.0.0 or later
@@ -114,7 +114,7 @@ tag pinned to the exact version (never the bare repository URL, which installs
 the latest release or default branch), confirm the trust prompt, then reload:
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.4.2
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.5.0
    /plugins reload
    ```
 

package/INSTALL.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.4.2 -->
+<!-- release-skill:release-version: 0.5.0 -->
 ## 前置条件
 
 - Node.js 22.0.0 或更高版本
@@ -104,7 +104,7 @@ Kimi Code 有交互式插件市场，但**没有可脚本化的非交互安装
 （切勿使用裸仓库地址，它会安装最新 release 或默认分支），确认信任提示后重新加载：
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.4.2
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.5.0
    /plugins reload
    ```
 

package/README.md

@@ -2,7 +2,7 @@
 
 [简体中文](README.zh-CN.md) · Installation: [English](INSTALL.md) / [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.4.2 -->
+<!-- release-skill:release-version: 0.5.0 -->
 Release preparation for Claude Code, CodeBuddy, WorkBuddy, Codex, and Kimi Code, with human-edited files kept intact.
 
 release-skill helps a maintainer answer three questions: what will be released,
@@ -14,21 +14,32 @@ Setup surfaces only the deterministic `compactSummary` review view; the full
 report stays in a temporary session directory.
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.4.2** (2026-08-12)
+**0.5.0** (2026-08-16)
 
-v0.4.2 makes the CodeBuddy consumer marketplace configurable per distribution instead of hardcoding a single marketplace, so CodeBuddy plugin distributions can target a project-declared marketplace source.
+v0.5.0 adopts the released Skill Family Foundation 0.4.0 packages (skill-family-contracts / skill-family-harness-node) for digest computation, atomic writes, contained file reads, and project locking; migrates the project lock domain to a single-file token lock with fail-closed legacy detection; hardens the online assess npm check against fail-open; and documents the hooks authorization contract as config-time authorization.
+
+**Added**
+
+- **Negative test coverage**: 12 additional tests covering exclusive publication, token-lock migration, and the assess npm-check behavior.
 
 **Changed**
 
+- **Foundation adoption**: digest computation, atomic writes, contained-path reads and project locking now delegate to the published `skill-family-contracts@0.4.0` / `skill-family-harness-node@0.4.0` packages instead of local implementations; dependencies bumped from 0.3.0 to 0.4.0.
+- **Token lock domain**: project locks migrated from a directory-based domain to a single `.release-skill/lock` file (0600, token record). Legacy directory-form locks are detected and fail closed with `LOCK_MIGRATION_REQUIRED`; no automatic conversion or deletion is performed.
+- **Exclusive plan/run publication**: immutable plan and run records are published via `publishFileExclusive` — identical bytes are idempotent, divergent bytes fail with `GATE_FAILED`.
+- **Assess npm check semantics**: the online `assess` npm check no longer treats every registry error as version-not-found; only E404/ETARGET mean a missing version, other failures surface as an `NPM_VERSION_CHECK_FAILED` warning.
+- **Hooks authorization contract**: release-prepare/release-help now document the explicit contract that configuring a hook in project configuration IS the authorization (hooks are arbitrary local processes with no sandbox, no filesystem/network isolation, and no pre-trigger confirmation point); restoring a mandatory pre-trigger confirmation gate is a future hardening item.
+- **Audit-scope ruling**: the bundled-family marketplace configuration is recorded as not applicable to the `release_artifact` target type (G3 target-side T4 ruling); T3/T5/T6 deferred to independent tasks.
 - **Plan schema**: production plans carry the resolved codebuddy marketplace coordinates so approval and publish review the exact marketplace target.
 
 **Fixed**
 
-- **Configurable CodeBuddy marketplace**: codebuddy-plugin distributions now accept `marketplace` and `marketplaceSource` in project configuration, and prepare threads both values into the consumer install action instead of assuming a fixed marketplace.
+- **Configurable CodeBuddy marketplace**: codebuddy-plugin distributions accept `marketplace` and `marketplaceSource` in project configuration, and prepare threads both values into the consumer install action instead of assuming a fixed marketplace.
+- **Assess fail-open**: an online `assess` no longer silently reports no gaps when the npm registry check fails for reasons other than a missing version.
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **Current boundary:** v0.4.2 is the current source candidate; v0.4.1 remains
+> **Current boundary:** v0.5.0 is the current source candidate; v0.4.1 remains
 > the latest published release (v0.2.2 previously held
 > published status before the platform verification convergence fix was added).
 > v0.1.1 completed a real production release to GitHub and npm — the first
@@ -47,7 +58,7 @@ v0.4.2 makes the CodeBuddy consumer marketplace configurable per distribution in
 > publish global preflight.
 
 <!-- release-skill:capability:safe-first-command -->
-> **Production path verified since the v0.1.1 milestone; v0.4.2 is the current
+> **Production path verified since the v0.1.1 milestone; v0.5.0 is the current
 > source candidate and v0.4.1 is the latest published release.** The npm-installed CLI is the supported user entry. Source checkout
 > is the development/contributor fallback.
 >

package/README.zh-CN.md

@@ -2,27 +2,38 @@
 
 [English](README.md) · 安装指南：[中文](INSTALL.zh-CN.md) / [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.4.2 -->
+<!-- release-skill:release-version: 0.5.0 -->
 面向 Claude Code、CodeBuddy、WorkBuddy、Codex 和 Kimi Code 的发布准备工具，完整保留人工维护的文件内容。
 
 release-skill 帮助维护者回答三个问题：准备发布什么、还有哪些检查未通过、最终发布的内容是什么。它不重新生成、也不回写项目源文件。`prepare` 把每个配置的公开文件复制到隔离快照并验证字节——先冻结并供人工审阅，再从同一份冻结产物发布。`setup` 只显示确定性的 `compactSummary` 审阅视图，完整报告保留在临时会话目录中。
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.4.2** (2026-08-12)
+**0.5.0** (2026-08-16)
 
-v0.4.2 将 CodeBuddy 消费者市场改为按分发渠道可配置，不再硬编码单一市场，CodeBuddy 插件分发可以指向项目声明的市场来源。
+v0.5.0 采用已发布的 Skill Family Foundation 0.4.0 包（skill-family-contracts / skill-family-harness-node）承载摘要计算、原子写、受控读取与项目锁；项目锁域迁移为单文件 token 锁并对旧目录形态 fail-closed；修复在线 assess npm 检查的 fail-open；并把 hooks 授权契约文档化为「配置时刻即授权」。
+
+**新增**
+
+- **新增负向测试**：新增 12 条测试覆盖排他发布、token 锁迁移与 assess npm 检查行为。
 
 **变更**
 
+- **Foundation 采用**：摘要计算、原子写、受控路径读取与项目锁改为委托已发布的 `skill-family-contracts@0.4.0` / `skill-family-harness-node@0.4.0` 包，依赖由 0.3.0 提升至 0.4.0。
+- **Token 锁域**：项目锁由目录形态迁移为单文件 `.release-skill/lock`（0600、token 记录）；旧目录形态锁被检测后 fail-closed（`LOCK_MIGRATION_REQUIRED`），不自动转换或删除。
+- **排他发布**：不可变计划与运行记录经 `publishFileExclusive` 发布——同字节幂等，异字节以 `GATE_FAILED` 失败。
+- **assess npm 检查语义**：在线 `assess` 的 npm 检查不再把一切 registry 错误当作「版本不存在」；仅 E404/ETARGET 视为缺失，其余失败以 `NPM_VERSION_CHECK_FAILED` 告警呈现。
+- **Hooks 授权契约**：release-prepare/release-help 现把「配置时刻即授权」写为显式契约——hook 是任意本地进程、无沙箱、无文件系统/网络隔离、触发前无确认点；恢复触发前强制确认门列为后续加固项。
+- **审计范围裁决**：bundled-family 市场型配置记录为不适用 `release_artifact` 目标类型（G3 目标侧 T4 裁决）；T3/T5/T6 延后为独立任务。
 - **计划模式**：生产计划携带解析后的 CodeBuddy 市场坐标，审批与发布时可核对确切的市场目标。
 
 **修复**
 
 - **CodeBuddy 市场可配置**：codebuddy-plugin 分发在项目配置中接受 `marketplace` 与 `marketplaceSource`，prepare 将两个值透传进消费者安装动作，不再假定固定市场。
+- **assess fail-open 修复**：在线 `assess` 不再因版本缺失以外的 npm registry 检查失败而静默报告无缺口。
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **当前边界：** v0.4.2 是当前源码候选，v0.4.1 仍是最新已发布版本（v0.2.2 曾处于已发布状态，后因平台验证收敛修复而更新）。
+> **当前边界：** v0.5.0 是当前源码候选，v0.4.1 仍是最新已发布版本（v0.2.2 曾处于已发布状态，后因平台验证收敛修复而更新）。
 > v0.1.1 已完成 GitHub 与 npm 的
 > 真实生产发布，是首次生产验证的历史里程碑，并从冻结 Git ref 完成精确 npm
 > 安装及 Claude/Codex 消费者安装验证；"当前发布版本"与"首次生产验证里程碑"
@@ -35,7 +46,7 @@ v0.4.2 将 CodeBuddy 消费者市场改为按分发渠道可配置，不再硬
 > 远端唯一性检查在 `publish` 全局预检执行。
 
 <!-- release-skill:capability:safe-first-command -->
-> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.4.2 是当前源码候选，v0.4.1 是最新已发布版本。**
+> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.5.0 是当前源码候选，v0.4.1 是最新已发布版本。**
 > npm 安装的 CLI 是受支持的用户入口；源码 checkout 保留为开发/贡献者路径。
 >
 > **第一条命令：**

package/adapters/claude/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "release-skill",
       "source": "./",
-      "version": "0.4.2",
+      "version": "0.5.0",
       "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
       "author": {
         "name": "广州市风荷科技有限公司"

package/adapters/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.4.2",
+  "version": "0.5.0",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/adapters/claude/bin/error-codes.json

@@ -0,0 +1,154 @@
+{
+  "schemaVersion": 1,
+  "kind": "skill-family.contracts.error-codes",
+  "contractsVersion": "1.4.0",
+  "policy": {
+    "format": "^SFC[0-9]{4}$",
+    "ranges": [
+      {
+        "prefix": "SFC1",
+        "category": "contract",
+        "note": "Contracts authority errors: schemas, registry, dialects, rules, fixtures."
+      },
+      {
+        "prefix": "SFC2",
+        "category": "kernel",
+        "note": "Kernel protocol operation errors."
+      },
+      {
+        "prefix": "SFC3",
+        "category": "report",
+        "note": "Report contract errors: digest binding, mandatory elements, fact drift. Style findings are never coded here; they are advisory output of the report check, not errors."
+      }
+    ],
+    "stability": "Codes are append-only. A frozen code is never reused for a different meaning; a deprecated code stays reserved. New codes require a contracts change."
+  },
+  "codes": [
+    {
+      "code": "SFC1001",
+      "name": "SCHEMA_VALIDATION_FAILED",
+      "category": "contract",
+      "stableSince": "1.0.0",
+      "meaning": "A document failed validation against its registered schema under the declared dialect and policy."
+    },
+    {
+      "code": "SFC1002",
+      "name": "UNKNOWN_SCHEMA_ID",
+      "category": "contract",
+      "stableSince": "1.0.0",
+      "meaning": "The referenced $id is not present in the schema registry."
+    },
+    {
+      "code": "SFC1003",
+      "name": "DUPLICATE_SCHEMA_ID",
+      "category": "contract",
+      "stableSince": "1.0.0",
+      "meaning": "Two schema registrations share the same $id; the registration is mechanically rejected."
+    },
+    {
+      "code": "SFC1004",
+      "name": "DUPLICATE_PROTOCOL_NAME",
+      "category": "contract",
+      "stableSince": "1.0.0",
+      "meaning": "Two protocol registrations share the same name and version; the registration is mechanically rejected."
+    },
+    {
+      "code": "SFC1005",
+      "name": "UNRESOLVED_REF",
+      "category": "contract",
+      "stableSince": "1.0.0",
+      "meaning": "A $ref target cannot be resolved within the registered schema set."
+    },
+    {
+      "code": "SFC1006",
+      "name": "UNSUPPORTED_DIALECT",
+      "category": "contract",
+      "stableSince": "1.0.0",
+      "meaning": "The declared JSON Schema dialect is not in the frozen supported dialect set."
+    },
+    {
+      "code": "SFC1007",
+      "name": "UNKNOWN_CHECK_TYPE",
+      "category": "contract",
+      "stableSince": "1.0.0",
+      "meaning": "A rule uses a check type outside the finite set of nine."
+    },
+    {
+      "code": "SFC1008",
+      "name": "RULE_BUDGET_EXCEEDED",
+      "category": "contract",
+      "stableSince": "1.0.0",
+      "meaning": "The mandatory rule count exceeds the first-version budget or the absolute cap."
+    },
+    {
+      "code": "SFC1009",
+      "name": "UNKNOWN_ERROR_CODE",
+      "category": "contract",
+      "stableSince": "1.0.0",
+      "meaning": "A fixture expectation references an error code that is not in this frozen registry."
+    },
+    {
+      "code": "SFC1010",
+      "name": "FIXTURE_EXPECTATION_MISMATCH",
+      "category": "contract",
+      "stableSince": "1.0.0",
+      "meaning": "A fixture did not behave as declared: a valid-expecting fixture failed, or an invalid-expecting fixture did not fail with the declared stable code."
+    },
+    {
+      "code": "SFC1011",
+      "name": "UNKNOWN_PROTOCOL",
+      "category": "contract",
+      "stableSince": "1.0.0",
+      "meaning": "A request references a protocol name/version that is not registered."
+    },
+    {
+      "code": "SFC1012",
+      "name": "SCHEMA_COMPILE_FAILED",
+      "category": "contract",
+      "stableSince": "1.0.0",
+      "meaning": "A registered schema does not compile under its declared dialect (the schema document itself is invalid)."
+    },
+    {
+      "code": "SFC2002",
+      "name": "UNKNOWN_OPERATION",
+      "category": "kernel",
+      "stableSince": "1.0.0",
+      "meaning": "The requested operation name is not in the frozen operation vocabulary of the referenced protocol version."
+    },
+    {
+      "code": "SFC2003",
+      "name": "INVALID_PARAMS",
+      "category": "kernel",
+      "stableSince": "1.0.0",
+      "meaning": "Operation params do not satisfy the frozen params contract of the requested operation."
+    },
+    {
+      "code": "SFC2004",
+      "name": "EXECUTION_FAILED",
+      "category": "kernel",
+      "stableSince": "1.0.0",
+      "meaning": "The mechanism runtime failed while executing a well-formed operation; details carry the mechanism evidence. Demonstrable only by a mechanism runtime, not by static contracts checks."
+    },
+    {
+      "code": "SFC3001",
+      "name": "REPORT_DIGEST_MISMATCH",
+      "category": "report",
+      "stableSince": "1.2.0",
+      "meaning": "A report binding digest (model, result, or report digest) does not match the recomputed sha256 digest, or the report is not the canonical render of its model; the binding is stale or tampered and is never trusted."
+    },
+    {
+      "code": "SFC3002",
+      "name": "REPORT_ELEMENT_MISSING",
+      "category": "report",
+      "stableSince": "1.2.0",
+      "meaning": "A mandatory report element is absent, empty where it must not be, or declared in an unsupported form: the conclusion, non-empty evidence, risks/next-action sections, a supported locale, or a coded outcome for failed/blocked runs. No half report is issued for a missing element."
+    },
+    {
+      "code": "SFC3003",
+      "name": "REPORT_FACT_DRIFT",
+      "category": "report",
+      "stableSince": "1.2.0",
+      "meaning": "A report model misstates the bound operation result's terminal state/errors, or rendered report bytes diverge from the deterministic re-render of the bound report model: fact fields rewritten, sections deleted, duplicated, or injected."
+    }
+  ]
+}

package/adapters/claude/bin/kernel-protocol.json

@@ -0,0 +1,60 @@
+{
+  "schemaVersion": 1,
+  "kind": "skill-family.kernel-protocol",
+  "name": "skill-family.kernel.operation",
+  "version": 1,
+  "status": "stable",
+  "contractsVersion": "1.4.0",
+  "description": "Frozen v1 kernel protocol: request/result envelope, operation lifecycle states, and the operation vocabulary. Extensible only by a new protocol version; v1 content is frozen.",
+  "states": ["accepted", "running", "succeeded", "failed", "rejected"],
+  "initialStates": ["accepted", "rejected"],
+  "terminalStates": ["succeeded", "failed", "rejected"],
+  "transitions": [
+    { "from": "accepted", "to": "running" },
+    { "from": "accepted", "to": "failed" },
+    { "from": "running", "to": "succeeded" },
+    { "from": "running", "to": "failed" }
+  ],
+  "stateRules": {
+    "intake": "A well-formed request enters accepted; an intake rejection (for example an unregistered protocol) enters rejected directly.",
+    "result": "An operation-result carries only terminal states; non-terminal states are never serialized in results.",
+    "synchronous": "A synchronous mechanism implementation may move accepted through running to a terminal state without exposing intermediate states."
+  },
+  "operations": [
+    {
+      "name": "validate",
+      "status": "stable",
+      "description": "Validate one document against one registered schema under a declared dialect and policy.",
+      "params": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["schemaId", "document"],
+        "properties": {
+          "schemaId": {
+            "type": "string",
+            "minLength": 1,
+            "description": "Registered $id of the target schema."
+          },
+          "document": {
+            "type": "object",
+            "description": "The document to validate."
+          },
+          "dialect": {
+            "type": "string",
+            "description": "Optional dialect override; must be in the supported dialect set."
+          },
+          "policy": {
+            "type": "string",
+            "description": "Optional validation policy name; defaults to strict."
+          }
+        }
+      }
+    }
+  ],
+  "resultContract": {
+    "outputs": {
+      "validate": "On success, outputs.report is an object with valid (boolean) and errors (array of normalized validation findings)."
+    },
+    "errors": "Every error entry carries a code from the frozen contracts error registry."
+  }
+}

package/adapters/claude/bin/registry.json

@@ -0,0 +1,165 @@
+{
+  "schemaVersion": 1,
+  "kind": "skill-family.contracts.registry",
+  "contractsVersion": "1.4.0",
+  "note": "Protocol-name and schema-$id registry. Registration mechanically rejects duplicate protocol name/version (SFC1004) and duplicate $id (SFC1003). This file is the single registration surface; adding an entry is a contracts change.",
+  "protocols": [
+    {
+      "name": "skill-family.kernel.operation",
+      "version": 1,
+      "status": "stable",
+      "definition": "src/kernel-protocol.json",
+      "description": "Kernel request/result envelope protocol for mechanism operations."
+    }
+  ],
+  "schemas": [
+    {
+      "$id": "https://contracts.skill-family.example/v1/project-manifest.json",
+      "object": "project-manifest",
+      "dialect": "2020-12",
+      "status": "stable",
+      "file": "src/schemas/project-manifest.schema.json"
+    },
+    {
+      "$id": "https://contracts.skill-family.example/v1/profile-descriptor.json",
+      "object": "profile-descriptor",
+      "dialect": "2020-12",
+      "status": "stable",
+      "file": "src/schemas/profile-descriptor.schema.json"
+    },
+    {
+      "$id": "https://contracts.skill-family.example/v1/managed-file-lock.json",
+      "object": "managed-file-lock",
+      "dialect": "2020-12",
+      "status": "stable",
+      "file": "src/schemas/managed-file-lock.schema.json"
+    },
+    {
+      "$id": "https://contracts.skill-family.example/v1/operation-request.json",
+      "object": "operation-request",
+      "dialect": "2020-12",
+      "status": "stable",
+      "file": "src/schemas/operation-request.schema.json"
+    },
+    {
+      "$id": "https://contracts.skill-family.example/v1/operation-result.json",
+      "object": "operation-result",
+      "dialect": "2020-12",
+      "status": "stable",
+      "file": "src/schemas/operation-result.schema.json"
+    },
+    {
+      "$id": "https://contracts.skill-family.example/v1/migration-manifest.json",
+      "object": "migration-manifest",
+      "dialect": "2020-12",
+      "status": "stable",
+      "file": "src/schemas/migration-manifest.schema.json"
+    },
+    {
+      "$id": "https://contracts.skill-family.example/v1/report-model.json",
+      "object": "report-model",
+      "dialect": "2020-12",
+      "status": "stable",
+      "file": "src/schemas/report-model.schema.json"
+    },
+    {
+      "$id": "https://contracts.skill-family.example/v1/report-binding.json",
+      "object": "report-binding",
+      "dialect": "2020-12",
+      "status": "stable",
+      "file": "src/schemas/report-binding.schema.json"
+    },
+    {
+      "$id": "https://contracts.skill-family.example/v1/host-descriptor.json",
+      "object": "host-descriptor",
+      "dialect": "2020-12",
+      "status": "stable",
+      "file": "src/schemas/host-descriptor.schema.json"
+    },
+    {
+      "$id": "https://contracts.skill-family.example/v1/host-registry.json",
+      "object": "host-registry",
+      "dialect": "2020-12",
+      "status": "stable",
+      "file": "src/schemas/host-registry.schema.json"
+    },
+    {
+      "$id": "https://contracts.skill-family.example/v1/adapter-source.json",
+      "object": "adapter-source",
+      "dialect": "2020-12",
+      "status": "stable",
+      "file": "src/schemas/adapter-source.schema.json"
+    },
+    {
+      "$id": "https://contracts.skill-family.example/v1/host-capability-fact.json",
+      "object": "host-capability-fact",
+      "dialect": "2020-12",
+      "status": "stable",
+      "file": "src/schemas/host-capability-fact.schema.json"
+    },
+    {
+      "$id": "https://contracts.skill-family.example/v1/host-probe-result.json",
+      "object": "host-probe-result",
+      "dialect": "2020-12",
+      "status": "stable",
+      "file": "src/schemas/host-probe-result.schema.json"
+    },
+    {
+      "$id": "https://contracts.skill-family.example/v1/adapter-build-manifest.json",
+      "object": "adapter-build-manifest",
+      "dialect": "2020-12",
+      "status": "stable",
+      "file": "src/schemas/adapter-build-manifest.schema.json"
+    },
+    {
+      "$id": "https://contracts.skill-family.example/v1/host-operation-plan.json",
+      "object": "host-operation-plan",
+      "dialect": "2020-12",
+      "status": "stable",
+      "file": "src/schemas/host-operation-plan.schema.json"
+    },
+    {
+      "$id": "https://contracts.skill-family.example/v1/host-operation-receipt.json",
+      "object": "host-operation-receipt",
+      "dialect": "2020-12",
+      "status": "stable",
+      "file": "src/schemas/host-operation-receipt.schema.json"
+    },
+    {
+      "$id": "https://contracts.skill-family.example/v1/state-event-envelope.json",
+      "object": "state-event-envelope",
+      "dialect": "2020-12",
+      "status": "stable",
+      "file": "src/schemas/state-event-envelope.schema.json"
+    },
+    {
+      "$id": "https://contracts.skill-family.example/v1/state-snapshot-metadata.json",
+      "object": "state-snapshot-metadata",
+      "dialect": "2020-12",
+      "status": "stable",
+      "file": "src/schemas/state-snapshot-metadata.schema.json"
+    },
+    {
+      "$id": "https://contracts.skill-family.example/v1/token-estimate-result.json",
+      "object": "token-estimate-result",
+      "dialect": "2020-12",
+      "status": "stable",
+      "file": "src/schemas/token-estimate-result.schema.json"
+    },
+    {
+      "$id": "https://contracts.skill-family.example/v1/surface-scan-policy.json",
+      "object": "surface-scan-policy",
+      "dialect": "2020-12",
+      "status": "stable",
+      "file": "src/schemas/surface-scan-policy.schema.json"
+    }
+  ],
+  "dialects": {
+    "supported": ["draft-07", "2020-12"],
+    "metaSchemaUris": {
+      "draft-07": "http://json-schema.org/draft-07/schema#",
+      "2020-12": "https://json-schema.org/draft/2020-12/schema"
+    },
+    "note": "Draft detection maps a schema $schema URI to a dialect name via metaSchemaUris; validation is routed to the matching Ajv class."
+  }
+}