release-skill 0.5.0 → 0.6.0

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "release-skill",
       "source": "./",
-      "version": "0.5.0",
+      "version": "0.6.0",
       "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
       "author": {
         "name": "广州市风荷科技有限公司"

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codebuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"
@@ -19,7 +19,7 @@
     ],
     "defaultPrompt": [
       "Assess this project for release readiness.",
-      "Prepare a release plan for version 0.5.0.",
+      "Prepare a release plan for version 0.6.0.",
       "Help me understand the release workflow."
     ]
   }

package/.kimi-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/CHANGELOG.md

@@ -1,5 +1,36 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.6.0 locale=en baseline=sha256:1942e4534cc9ab36065168471875ba8c4648c73328a20ef3ee6a7a53eb1f1b7d -->
+## [0.6.0] - 2026-08-18
+
+v0.6.0 automates the most error-prone bookkeeping step of the release loop: after a release reaches VERIFIED, verify now advances each unit's previousPublicBaseline in project.yaml to the just-published commit, tree, and manifest digest recorded in the frozen plan. The advance is local-only, idempotent, validated with automatic rollback, and commits the config file on its own only when it was clean before the write, so the drift gate always sees a truthful previous public baseline without anyone hand-copying hashes.
+
+### Added
+
+- **Automatic baseline advance (baseline-advance)**: after `verify` reaches `VERIFIED`, every `mode: bound` unit's `previousPublicBaseline` (`commit`, `tree`, `manifestDigest`) is advanced to the published values derived from the frozen plan's `push-snapshot` binding — never recomputed from workspace state. The rewritten `project.yaml` preserves comments, is re-validated with `loadProjectConfig`, and is restored byte-for-byte if validation fails. The advance never demotes `VERIFIED`: failures are recorded in evidence and reported for manual handling.
+- **Clean-worktree commit policy**: the baseline advance auto-commits the config file in an isolated commit only when `project.yaml` had no staged or unstaged changes before the write; a dirty worktree leaves the file written but uncommitted for human review, and a missing or broken git fails safe to never committing.
+- **Ship-state traceability**: `ship` persists the verify `baselineAdvance` result (`advanced` / `already-current` / `committed` / `failed`) in its durable state, and the `verify` human-readable output reports the advance outcome line.
+<!-- release-skill:changelog:end version=0.6.0 locale=en -->
+
+
+<!-- release-skill:changelog:start version=0.5.1 locale=en baseline=sha256:2a8dc4241570c0919e55da270233728963ba1cda347c95c775678ec89a9f0ac0 -->
+## [0.5.1] - 2026-08-17
+
+v0.5.1 fixes three frozen-0.5.0 defects — explicit hook environment delivery (envAllowlist now reaches prepare hooks), a 64 MiB baseline maxBuffer for large tracked indexes, and the prefixed skill-directory fallback for marketplace-install preflight/observe — bumps the Skill Family Foundation dependencies to the released 0.5.0 packages, and hardens the release chain so every later release must bind the previous public release commit instead of degrading to an orphan root commit.
+
+### Changed
+
+- **Foundation 0.5.0 upgrade**: `skill-family-contracts` and `skill-family-harness-node` dependencies bumped from 0.4.0 to 0.5.0 (npm latest); the package-name import bridge keeps working unchanged and the harness-node 0.5.0 export surface was re-verified (`publishFileExclusive`, token-lock five functions, `HARNESS_ERROR_KINDS`).
+- **Chain hardening (chain-integrity)**: `push-snapshot` now requires an explicit `branchStrategy` (the historical `create-release-branch` default that produced orphan root commits is gone); `create-release-branch` is only valid when `previousPublicBaseline.mode=none`; a production online prepare with `mode=none` on a repository that already carries release tags fails closed with `CHAIN_GAP`, demanding a bound baseline at the previous release commit; online `assess` registers a warning-level `VERSION_SEQUENCE_GAP` when the target version jumps the release sequence (e.g. 0.1.1 → 0.1.3 with no v0.1.2 tag), without blocking.
+
+### Fixed
+
+- **Hook environment delivery (hook-env-delivery)**: `runDeclaredHooks` now accepts an explicit `env` option and merges it into the hook context (`hookFn(hook, { root, env })`); prepare and `hooks validate` inject the invoking shell's environment, so `hooks.*.envAllowlist` keys exported by the caller finally reach the hook subprocess. Allowlist semantics are unchanged — the hook runner still reads allowlisted keys exclusively from the explicit map, never from `process.env` directly.
+- **Large-tracked-index baseline (baseline-maxbuffer)**: `computeWorkspaceDigest` now runs its three git subprocesses with a 64 MiB `maxBuffer` (official fix 39c631f); workspaces with thousands of tracked files (measured 8494 tracked files → 1,519,151 B `ls-files -s` stdout) no longer fail with `ERR_CHILD_PROCESS_STDIO_MAXBUFFER`.
+- **Prefixed skill-directory resolution (entry-skill-prefix)**: marketplace-install preflight and observe now fall back from `skills/<entrySkill>/SKILL.md` to `skills/<plugin>-<entrySkill>/SKILL.md` (plugin from the action parameters, D-ACA-30 platform physical names); candidate builds with prefixed skill directories pass preflight and observe instead of failing with `entry skill not found`.
+<!-- release-skill:changelog:end version=0.5.1 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.5.0 locale=en baseline=sha256:e59bef4bd7bc6e0809d1f415d7ff3d342e45a7e77075f66d6ffa48cfd9b71932 -->
 ## [0.5.0] - 2026-08-16
 

package/INSTALL.md

@@ -2,7 +2,7 @@
 
 [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.5.0 -->
+<!-- release-skill:release-version: 0.6.0 -->
 ## Prerequisites
 
 - Node.js 22.0.0 or later
@@ -114,7 +114,7 @@ tag pinned to the exact version (never the bare repository URL, which installs
 the latest release or default branch), confirm the trust prompt, then reload:
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.5.0
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.6.0
    /plugins reload
    ```
 

package/INSTALL.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.5.0 -->
+<!-- release-skill:release-version: 0.6.0 -->
 ## 前置条件
 
 - Node.js 22.0.0 或更高版本
@@ -104,7 +104,7 @@ Kimi Code 有交互式插件市场，但**没有可脚本化的非交互安装
 （切勿使用裸仓库地址，它会安装最新 release 或默认分支），确认信任提示后重新加载：
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.5.0
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.6.0
    /plugins reload
    ```
 

package/README.md

@@ -2,7 +2,7 @@
 
 [简体中文](README.zh-CN.md) · Installation: [English](INSTALL.md) / [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.5.0 -->
+<!-- release-skill:release-version: 0.6.0 -->
 Release preparation for Claude Code, CodeBuddy, WorkBuddy, Codex, and Kimi Code, with human-edited files kept intact.
 
 release-skill helps a maintainer answer three questions: what will be released,
@@ -14,32 +14,19 @@ Setup surfaces only the deterministic `compactSummary` review view; the full
 report stays in a temporary session directory.
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.5.0** (2026-08-16)
+**0.6.0** (2026-08-18)
 
-v0.5.0 adopts the released Skill Family Foundation 0.4.0 packages (skill-family-contracts / skill-family-harness-node) for digest computation, atomic writes, contained file reads, and project locking; migrates the project lock domain to a single-file token lock with fail-closed legacy detection; hardens the online assess npm check against fail-open; and documents the hooks authorization contract as config-time authorization.
+v0.6.0 automates the most error-prone bookkeeping step of the release loop: after a release reaches VERIFIED, verify now advances each unit's previousPublicBaseline in project.yaml to the just-published commit, tree, and manifest digest recorded in the frozen plan. The advance is local-only, idempotent, validated with automatic rollback, and commits the config file on its own only when it was clean before the write, so the drift gate always sees a truthful previous public baseline without anyone hand-copying hashes.
 
 **Added**
 
-- **Negative test coverage**: 12 additional tests covering exclusive publication, token-lock migration, and the assess npm-check behavior.
-
-**Changed**
-
-- **Foundation adoption**: digest computation, atomic writes, contained-path reads and project locking now delegate to the published `skill-family-contracts@0.4.0` / `skill-family-harness-node@0.4.0` packages instead of local implementations; dependencies bumped from 0.3.0 to 0.4.0.
-- **Token lock domain**: project locks migrated from a directory-based domain to a single `.release-skill/lock` file (0600, token record). Legacy directory-form locks are detected and fail closed with `LOCK_MIGRATION_REQUIRED`; no automatic conversion or deletion is performed.
-- **Exclusive plan/run publication**: immutable plan and run records are published via `publishFileExclusive` — identical bytes are idempotent, divergent bytes fail with `GATE_FAILED`.
-- **Assess npm check semantics**: the online `assess` npm check no longer treats every registry error as version-not-found; only E404/ETARGET mean a missing version, other failures surface as an `NPM_VERSION_CHECK_FAILED` warning.
-- **Hooks authorization contract**: release-prepare/release-help now document the explicit contract that configuring a hook in project configuration IS the authorization (hooks are arbitrary local processes with no sandbox, no filesystem/network isolation, and no pre-trigger confirmation point); restoring a mandatory pre-trigger confirmation gate is a future hardening item.
-- **Audit-scope ruling**: the bundled-family marketplace configuration is recorded as not applicable to the `release_artifact` target type (G3 target-side T4 ruling); T3/T5/T6 deferred to independent tasks.
-- **Plan schema**: production plans carry the resolved codebuddy marketplace coordinates so approval and publish review the exact marketplace target.
-
-**Fixed**
-
-- **Configurable CodeBuddy marketplace**: codebuddy-plugin distributions accept `marketplace` and `marketplaceSource` in project configuration, and prepare threads both values into the consumer install action instead of assuming a fixed marketplace.
-- **Assess fail-open**: an online `assess` no longer silently reports no gaps when the npm registry check fails for reasons other than a missing version.
+- **Automatic baseline advance (baseline-advance)**: after `verify` reaches `VERIFIED`, every `mode: bound` unit's `previousPublicBaseline` (`commit`, `tree`, `manifestDigest`) is advanced to the published values derived from the frozen plan's `push-snapshot` binding — never recomputed from workspace state. The rewritten `project.yaml` preserves comments, is re-validated with `loadProjectConfig`, and is restored byte-for-byte if validation fails. The advance never demotes `VERIFIED`: failures are recorded in evidence and reported for manual handling.
+- **Clean-worktree commit policy**: the baseline advance auto-commits the config file in an isolated commit only when `project.yaml` had no staged or unstaged changes before the write; a dirty worktree leaves the file written but uncommitted for human review, and a missing or broken git fails safe to never committing.
+- **Ship-state traceability**: `ship` persists the verify `baselineAdvance` result (`advanced` / `already-current` / `committed` / `failed`) in its durable state, and the `verify` human-readable output reports the advance outcome line.
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **Current boundary:** v0.5.0 is the current source candidate; v0.4.1 remains
+> **Current boundary:** v0.6.0 is the current source candidate; v0.4.1 remains
 > the latest published release (v0.2.2 previously held
 > published status before the platform verification convergence fix was added).
 > v0.1.1 completed a real production release to GitHub and npm — the first
@@ -58,7 +45,7 @@ v0.5.0 adopts the released Skill Family Foundation 0.4.0 packages (skill-family-
 > publish global preflight.
 
 <!-- release-skill:capability:safe-first-command -->
-> **Production path verified since the v0.1.1 milestone; v0.5.0 is the current
+> **Production path verified since the v0.1.1 milestone; v0.6.0 is the current
 > source candidate and v0.4.1 is the latest published release.** The npm-installed CLI is the supported user entry. Source checkout
 > is the development/contributor fallback.
 >
@@ -66,6 +53,11 @@ v0.5.0 adopts the released Skill Family Foundation 0.4.0 packages (skill-family-
 > - npm install: `npm install -g release-skill` → `release-skill help`
 > - source checkout: `node "$RELEASE_SKILL_HOME/packages/release-skill/bin/release-skill.mjs" help`
 
+<!-- release-skill:maturity:distribute-v1 -->
+<!-- release-skill:capability:distribute -->
+> **Distribute maturity v1.0 (W2 closure):** postPublish distribution is available as a separate `distribute` command for mirror and marketplace-index actions. After `publish` reaches PUBLISHED status, run `ship distribute` or manually invoke `release-skill distribute --plan <path> --approval <path> --json`. The distribute action implements fail-closed semantics: NO_CHANGE on empty diff (no commit/tag/push), REMOTE_CONFLICT on tag move attempts (never force-push), AUTH_MISSING when external writes are not authorized. Supported modes: `--dry-run` (local commit+tag only), `--json` (structured output), `--help` (command reference). Tag commitment guarantees version consistency — distributed plugin.json.version must match input tag. See [docs/design/2026-08-17-postpublish-distribution.md](../../docs/design/2026-08-17-postpublish-distribution.md) for detailed architecture.
+<!-- release-skill:capability:distribute -->
+
 <!-- release-skill:maturity:v0.1-boundary -->
 <!-- release-skill:maturity:boundary -->
 > **Safe defaults:** the recommended path is `help → assess → prepare --offline →

package/README.zh-CN.md

@@ -2,38 +2,25 @@
 
 [English](README.md) · 安装指南：[中文](INSTALL.zh-CN.md) / [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.5.0 -->
+<!-- release-skill:release-version: 0.6.0 -->
 面向 Claude Code、CodeBuddy、WorkBuddy、Codex 和 Kimi Code 的发布准备工具，完整保留人工维护的文件内容。
 
 release-skill 帮助维护者回答三个问题：准备发布什么、还有哪些检查未通过、最终发布的内容是什么。它不重新生成、也不回写项目源文件。`prepare` 把每个配置的公开文件复制到隔离快照并验证字节——先冻结并供人工审阅，再从同一份冻结产物发布。`setup` 只显示确定性的 `compactSummary` 审阅视图，完整报告保留在临时会话目录中。
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.5.0** (2026-08-16)
+**0.6.0** (2026-08-18)
 
-v0.5.0 采用已发布的 Skill Family Foundation 0.4.0 包（skill-family-contracts / skill-family-harness-node）承载摘要计算、原子写、受控读取与项目锁；项目锁域迁移为单文件 token 锁并对旧目录形态 fail-closed；修复在线 assess npm 检查的 fail-open；并把 hooks 授权契约文档化为「配置时刻即授权」。
+v0.6.0 把发布循环中最容易出错的一步记账工作自动化了：发布到达 VERIFIED 后，verify 会自动把 project.yaml 中每个 unit 的 previousPublicBaseline 推进到本次已发布的 commit、tree 与 manifest digest，数值全部取自冻结计划的记录。推进只写本地、幂等、写回后自动校验并在失败时原样回滚，并且只在写回前文件干净时才用独立提交落库——漂移门禁从此总是看到真实的前序公开基线，不再需要任何人手工抄写哈希。
 
 **新增**
 
-- **新增负向测试**：新增 12 条测试覆盖排他发布、token 锁迁移与 assess npm 检查行为。
-
-**变更**
-
-- **Foundation 采用**：摘要计算、原子写、受控路径读取与项目锁改为委托已发布的 `skill-family-contracts@0.4.0` / `skill-family-harness-node@0.4.0` 包，依赖由 0.3.0 提升至 0.4.0。
-- **Token 锁域**：项目锁由目录形态迁移为单文件 `.release-skill/lock`（0600、token 记录）；旧目录形态锁被检测后 fail-closed（`LOCK_MIGRATION_REQUIRED`），不自动转换或删除。
-- **排他发布**：不可变计划与运行记录经 `publishFileExclusive` 发布——同字节幂等，异字节以 `GATE_FAILED` 失败。
-- **assess npm 检查语义**：在线 `assess` 的 npm 检查不再把一切 registry 错误当作「版本不存在」；仅 E404/ETARGET 视为缺失，其余失败以 `NPM_VERSION_CHECK_FAILED` 告警呈现。
-- **Hooks 授权契约**：release-prepare/release-help 现把「配置时刻即授权」写为显式契约——hook 是任意本地进程、无沙箱、无文件系统/网络隔离、触发前无确认点；恢复触发前强制确认门列为后续加固项。
-- **审计范围裁决**：bundled-family 市场型配置记录为不适用 `release_artifact` 目标类型（G3 目标侧 T4 裁决）；T3/T5/T6 延后为独立任务。
-- **计划模式**：生产计划携带解析后的 CodeBuddy 市场坐标，审批与发布时可核对确切的市场目标。
-
-**修复**
-
-- **CodeBuddy 市场可配置**：codebuddy-plugin 分发在项目配置中接受 `marketplace` 与 `marketplaceSource`，prepare 将两个值透传进消费者安装动作，不再假定固定市场。
-- **assess fail-open 修复**：在线 `assess` 不再因版本缺失以外的 npm registry 检查失败而静默报告无缺口。
+- **基线自动推进（baseline-advance）**：`verify` 到达 `VERIFIED` 后，每个 `mode: bound` unit 的 `previousPublicBaseline`（`commit`、`tree`、`manifestDigest`）自动推进到冻结计划 `push-snapshot` 绑定中的已发布值——绝不从工作区状态重新计算。写回的 `project.yaml` 保留注释，经 `loadProjectConfig` 重新校验，校验失败时逐字节还原。推进失败不会降级 `VERIFIED`：失败记录进证据并提示人工处理。
+- **干净工作区提交策略**：仅当写回前 `project.yaml` 没有任何暂存或未暂存改动时，基线推进才用一次独立提交只包含该文件；工作区有在途改动时只落盘不提交、留给人工复核；git 缺失或损坏时安全失败为永不提交。
+- **ship 状态可追溯**：`ship` 把 verify 的 `baselineAdvance` 结果（`advanced` / `already-current` / `committed` / `failed`）写入持久状态；`verify` 的人类可读输出新增推进结果行。
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **当前边界：** v0.5.0 是当前源码候选，v0.4.1 仍是最新已发布版本（v0.2.2 曾处于已发布状态，后因平台验证收敛修复而更新）。
+> **当前边界：** v0.6.0 是当前源码候选，v0.4.1 仍是最新已发布版本（v0.2.2 曾处于已发布状态，后因平台验证收敛修复而更新）。
 > v0.1.1 已完成 GitHub 与 npm 的
 > 真实生产发布，是首次生产验证的历史里程碑，并从冻结 Git ref 完成精确 npm
 > 安装及 Claude/Codex 消费者安装验证；"当前发布版本"与"首次生产验证里程碑"
@@ -46,20 +33,25 @@ v0.5.0 采用已发布的 Skill Family Foundation 0.4.0 包（skill-family-contr
 > 远端唯一性检查在 `publish` 全局预检执行。
 
 <!-- release-skill:capability:safe-first-command -->
-> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.5.0 是当前源码候选，v0.4.1 是最新已发布版本。**
+> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.6.0 是当前源码候选，v0.4.1 是最新已发布版本。**
 > npm 安装的 CLI 是受支持的用户入口；源码 checkout 保留为开发/贡献者路径。
 >
 > **第一条命令：**
 > - npm 安装：`npm install -g release-skill` → `release-skill help`
 > - 源码 checkout：`node "$RELEASE_SKILL_HOME/packages/release-skill/bin/release-skill.mjs" help`
 
+<!-- release-skill:maturity:distribute-v1 -->
+<!-- release-skill:capability:distribute -->
+> **分发能力 v1.0（W2 完成）：** postPublish 分发作为独立的 `distribute` 命令可用，支持镜像和 Marketplace 索引动作。`publish` 达到 PUBLISHED 状态后，可运行 `ship distribute` 或手动调用 `release-skill distribute --plan <path> --approval <path> --json`。分发动作实现 fail-closed 语义：空差异时 NO_CHANGE（不创建 commit/tag/push），tag 移动尝试时 REMOTE_CONFLICT（永不 force-push），外部写未授权时 AUTH_MISSING。支持的模式：`--dry-run`（仅本地提交+tag）、`--json`（结构化输出）、`--help`（命令参考）。标签承诺保证版本一致性——分发的 plugin.json.version 必须与输入 tag 匹配。详见 [docs/design/2026-08-17-postpublish-distribution.md](../../docs/design/2026-08-17-postpublish-distribution.md) 中的架构说明。
+<!-- release-skill:capability:distribute -->
+
 <!-- release-skill:maturity:v0.1-boundary -->
 <!-- release-skill:maturity:boundary -->
 > **安全默认路径：** 推荐 `help → assess → prepare --offline → 人工审阅`。
 > `help` 与 `assess` 只读；`prepare --offline` 中由 release-skill 自身控制的部分只写
 > `.release-skill/`，且不调用远端发布适配器。但配置的 hook 和 gate 是无操作系统沙箱的进程，
 > 可以写出项目目录、访问凭据、发起网络请求或执行远端发布。只有未配置这些进程，或已单独审计并
-> 显式确认其副作用时，才可以把 `prepare` 视为“仅本地”。生产发布使用
+> 显式确认其副作用时，才可以把 `prepare` 视为”仅本地”。生产发布使用
 > `ship --target-version <ver> → ship --approve --actor <name>`。
 > `ship` 自动执行 hooks 和门禁，唯一的人工门禁是计划批准。
 > Kimi/CodeBuddy 安装是非阻塞的人工后续任务（系统不核验）。

package/adapters/claude/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "release-skill",
       "source": "./",
-      "version": "0.5.0",
+      "version": "0.6.0",
       "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
       "author": {
         "name": "广州市风荷科技有限公司"

package/adapters/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/adapters/claude/bin/error-codes.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "kind": "skill-family.contracts.error-codes",
-  "contractsVersion": "1.4.0",
+  "contractsVersion": "1.5.0",
   "policy": {
     "format": "^SFC[0-9]{4}$",
     "ranges": [

package/adapters/claude/bin/kernel-protocol.json

@@ -4,7 +4,7 @@
   "name": "skill-family.kernel.operation",
   "version": 1,
   "status": "stable",
-  "contractsVersion": "1.4.0",
+  "contractsVersion": "1.5.0",
   "description": "Frozen v1 kernel protocol: request/result envelope, operation lifecycle states, and the operation vocabulary. Extensible only by a new protocol version; v1 content is frozen.",
   "states": ["accepted", "running", "succeeded", "failed", "rejected"],
   "initialStates": ["accepted", "rejected"],

package/adapters/claude/bin/registry.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "kind": "skill-family.contracts.registry",
-  "contractsVersion": "1.4.0",
+  "contractsVersion": "1.5.0",
   "note": "Protocol-name and schema-$id registry. Registration mechanically rejects duplicate protocol name/version (SFC1004) and duplicate $id (SFC1003). This file is the single registration surface; adding an entry is a contracts change.",
   "protocols": [
     {
@@ -152,6 +152,20 @@
       "dialect": "2020-12",
       "status": "stable",
       "file": "src/schemas/surface-scan-policy.schema.json"
+    },
+    {
+      "$id": "https://contracts.skill-family.example/v1/declared-read-surface-result.json",
+      "object": "declared-read-surface-result",
+      "dialect": "2020-12",
+      "status": "stable",
+      "file": "src/schemas/declared-read-surface-result.schema.json"
+    },
+    {
+      "$id": "https://contracts.skill-family.example/v1/structured-scan-policy.json",
+      "object": "structured-scan-policy",
+      "dialect": "2020-12",
+      "status": "stable",
+      "file": "src/schemas/structured-scan-policy.schema.json"
     }
   ],
   "dialects": {