release-skill 0.6.2 → 0.7.0

package/README.zh-CN.md

@@ -2,29 +2,37 @@
 
 [English](README.md) · 安装指南：[中文](INSTALL.zh-CN.md) / [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.6.2 -->
+<!-- release-skill:release-version: 0.7.0 -->
 面向 Claude Code、CodeBuddy、WorkBuddy、Codex 和 Kimi Code 的发布准备工具，完整保留人工维护的文件内容。
 
 release-skill 帮助维护者回答三个问题：准备发布什么、还有哪些检查未通过、最终发布的内容是什么。它不重新生成、也不回写项目源文件。`prepare` 把每个配置的公开文件复制到隔离快照并验证字节——先冻结并供人工审阅，再从同一份冻结产物发布。`setup` 只显示确定性的 `compactSummary` 审阅视图，完整报告保留在临时会话目录中。
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.6.2** (2026-08-19)
+**0.7.0** (2026-08-22)
 
-v0.6.2 把技能资源闭包检查器升级为贯穿 prepare、publish、verify 的失败关闭发布门禁，收口逐条审计确认的五项缺口（G1–G5），并修复 lineage 重建提交时的身份解析错误：缺失或漂移的技能资源、主目录搜索路径、未声明的 host 面从此在计划冻结前即阻断发布；提交身份改用锚定正则解析，解析失败即失败关闭，绝不伪造身份字段。
+v0.7.0 收口了 v0.6.3 之后识别出的发布架构缺口：postPublish 私有执行输入随批准计划冻结，检查点批准只能从不可变权威路径消费，下游投影直接复用已发布的 Skill Family Foundation 0.8.0 合同，不再依赖工作区本地替代实现。
 
 **新增**
 
-- **skill-resource-closure v2 发布门禁**：闭包检查器升级为贯穿三个阶段的失败关闭门禁——prepare 扫描冻结快照，任何 finding 即以 `GATE_FAILED`（错误码 13）阻断计划冻结；publish Gate 2c 对 production 计划按已验证的冻结快照重算闭包；verify 以逐 host 收据校验真实 npm 安装树与 marketplace 安装目录。收据新增 `unitId`、host/surface 明细、摘要、`checkerVersion`（`skill-resource-closure-v2`）与计数字段；平台注册表以显式 adapter 目录名声明各 host 面；收据 schema 在全部六份 release-plan schema 副本中绑定。旧冻结计划与新 checker 版本不一致即失败关闭。
-- **闭包门禁缺口收口（G1–G5）**：source-only（`SOURCE_ONLY_NOT_SHIPPED`）豁免逐条列入收据投影与 prepare 证据——可审计、非阻断；code span/fence/link 目标中的 `~/`、`$HOME/`、`${HOME}/` 搜索路径以 `HOME_DIRECTORY_SEARCH` 失败关闭；同名相对路径资源跨 surface 内容不一致以 `RESOURCE_DRIFT` 失败关闭并给出跨 surface 引用定位；adapter 技能闭包目录内未被引用的常规文件以 `STALE_RESOURCE` 失败关闭；每个声明的插件分发必须有 skillCount ≥ 1 的收据 host 面背书（declared-host 对账）——publicFiles 漏收 adapter 时该 host 面不再静默缺席；冻结收据绑定确定性 `preparedAt` 冻结时间戳（绝不采样墙钟）与 `exitCode: 0`，同输入重复 prepare 冻结字节一致的收据。
+- **冻结 postPublish 执行包**：发布单元可以声明私有 `executionFiles`；prepare 把精确字节及资源闭包冻结进不可变计划，distribute 或 postVerify 只把复验通过的执行包安装到隔离执行工作树。批准后的实时工作区改动无法改变实际执行命令。
+- **从权威路径消费检查点批准**：postPublish 批准只接受由计划摘要和 hook id 推导出的规范路径。任何 hook 或外部写入开始前，消费端都会复核计划摘要、批准摘要、严格读取的文件字节，以及整条权威路径不存在符号链接。
+- **由 Foundation 托管下游投影**：postPublish 载荷投影改用已发布的 `skill-family-engineering-kit` 投影编译器和运行器，并通过 `skill-family-harness-node` 完成严格读取与资源闭包复验。
+
+**变更**
+
+- **区分两类工作区**：预设执行明确区分维护者的 `releaseWorkspaceRoot` 与隔离的 `executionWorktreeRoot`；拒绝含义模糊的旧 `root` 回退，也不允许预设把发布工作区自身作为目标。
+- **精确采用 Foundation 0.8.0**：`skill-family-contracts`、`skill-family-harness-node` 与 `skill-family-engineering-kit` 均钉扎 0.8.0；包运行时钉扎 Node.js `>=22.22.2 <23`。
+- **显式 distribute 权威**：`distribute` 必须取得与计划绑定的发布批准记录；postPublish hook 批准继续使用独立的检查点记录。
 
 **修复**
 
-- **lineage 提交身份解析（lineage-ident）**：`lineage rebuild` 原先用 `split(/\s+>/)` 解析 author/committer ident 行——该切分对合法 ident 从不匹配，写进重建提交的身份因此损坏（名字含空格或 `>` 时同样错乱）。现改用锚定正则解析，贪婪名字捕获使行尾最后一个 `<email> ts tz` 组生效；无法解析即失败关闭，绝不伪造身份字段。提交消息改经 `commit-tree -F -` stdin 喂入，取自不裁剪的 `cat-file` 输出——任意消息字节（含尾部空白与空行）原样保留。
-- **assess npm-transport 测试稳定性（仅测试）**：npm 生命周期向子进程环境注入静默日志级别设置与环境代理变量，导致 npm stderr 被清空、释放后的本地临时端口被劫持，测试间歇性失败。现剥离环境中的 npm-config 族环境键与代理变量（`isolateNpmTransportEnv`），整个测试期间持有本地端口（`startConnectionResetRegistry`），并确定性断言 `ECONNRESET|ECONNREFUSED`。生产行为无变化。
+- **拒绝并脱敏携带凭证的 Git URL**：配置中的 Git 远端在 schema 与运行时两层拒绝 URL userinfo。错误、证据和摘要统一经过共享脱敏路径，避免持久化嵌入式凭证。
+- **生产门禁失败关闭**：`NODE_TEST_CONTEXT` 不再能够豁免派生产物门禁；adapter 按计划版本明确处理语义；兼容 Node.js 22 的测试报告格式，同时不放宽断言。
+- **公开打包与许可证收口**：工作区说明与公开包统一采用 Apache-2.0，公开 bundle 同时携带所需的 Apache-2.0 与 MIT 许可证正文。
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **当前边界：** v0.6.2 是当前源码候选，v0.4.1 仍是最新已发布版本（v0.2.2 曾处于已发布状态，后因平台验证收敛修复而更新）。
+> **当前边界：** v0.7.0 是当前源码候选，v0.6.3 是最新已发布版本。v0.4.1 是更早的已发布里程碑（v0.2.2 曾处于已发布状态，后因平台验证收敛修复而更新）。
 > v0.1.1 已完成 GitHub 与 npm 的
 > 真实生产发布，是首次生产验证的历史里程碑，并从冻结 Git ref 完成精确 npm
 > 安装及 Claude/Codex 消费者安装验证；"当前发布版本"与"首次生产验证里程碑"
@@ -37,7 +45,7 @@ v0.6.2 把技能资源闭包检查器升级为贯穿 prepare、publish、verify
 > 远端唯一性检查在 `publish` 全局预检执行。
 
 <!-- release-skill:capability:safe-first-command -->
-> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.6.2 是当前源码候选，v0.4.1 是最新已发布版本。**
+> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.7.0 是当前源码候选，v0.6.3 是最新已发布版本。**
 > npm 安装的 CLI 是受支持的用户入口；源码 checkout 保留为开发/贡献者路径。
 >
 > **第一条命令：**
@@ -49,6 +57,45 @@ v0.6.2 把技能资源闭包检查器升级为贯穿 prepare、publish、verify
 > **分发能力 v1.0（W2 完成）：** postPublish 分发作为独立的 `distribute` 命令可用，支持镜像和 Marketplace 索引动作。`publish` 达到 PUBLISHED 状态后，可运行 `ship distribute` 或手动调用 `release-skill distribute --plan <path> --approval <path> --json`。分发动作实现 fail-closed 语义：空差异时 NO_CHANGE（不创建 commit/tag/push），tag 移动尝试时 REMOTE_CONFLICT（永不 force-push），外部写未授权时 AUTH_MISSING。支持的模式：`--dry-run`（仅本地提交+tag）、`--json`（结构化输出）、`--help`（命令参考）。标签承诺保证版本一致性——分发的 plugin.json.version 必须与输入 tag 匹配。详见 [docs/design/2026-08-17-postpublish-distribution.md](../../docs/design/2026-08-17-postpublish-distribution.md) 中的架构说明。
 <!-- release-skill:capability:distribute -->
 
+<!-- release-skill:maturity:postpublish-hooks-v2 -->
+<!-- release-skill:capability:postpublish-hooks -->
+> **postPublish hooks v2：** `releaseUnit.postPublish` 在既有 `targets` 之外接受
+> 声明式 `hooks` 数组。每个 hook 要么是命名预设，要么是自定义 command hook；
+> 自定义 command hook 遵循与 prepare hooks 相同的规则——可执行文件/参数数组、
+> 相对 cwd、timeout 与环境变量白名单，拒绝 shell 字符串——并与其他配置的
+> hook 和 gate 一样是无操作系统沙箱的进程。所有声明归一化进冻结计划，因此
+> hook 变化即 plan digest 变化，既有批准随之失效。`requiresApproval: true`
+> 的 hook（公开写预设缺省为 true；项目可以收紧，不得放松）执行前需要自己的
+> checkpoint 级批准：用
+> `release-skill approve --plan <plan> --hook <hookId> --actor <name>`
+> 铸造批准记录，再由 `distribute --hook-approval <record>` 或
+> `ship --hook-approval <record>` 消费（24 小时有效期，绑定 plan digest
+> 与 hook id）。Git 凭证只来自宿主 credential helper / OS keychain；
+> release-skill 绝不读取、存储或打印凭证。
+<!-- release-skill:capability:postpublish-hooks -->
+
+<!-- release-skill:capability:postpublish-presets -->
+> **postPublish 预设：** 六个内置预设随 bundle 分发，由
+> `release-skill distribute --list-presets` 枚举：`git-mirror` 与
+> `marketplace-index-render`（以 `targets` 形态声明），以及
+> `proposal-inbox`、`marketplace-registry-entry`、`docs-refresh`、
+> `notify-handoff`（以 `hooks` 形态声明）。`proposal-inbox` 通过 git-push 或
+> local-file 传输投递机器可读更新提案，供下游自治消费；未声明 target 时
+> 退化为 `notify-handoff` 行为而非报错。`notify-handoff` 是零写地板：
+> 只渲染确定性的人工同步清单。release-skill 自己也在使用该能力：本仓库的
+> 项目配置声明了一个 `proposal-inbox`（git-push）hub 提案，指向公开仓
+> `skill-family-hub`，将在 v0.7.0 发布的 postVerify 阶段经自身的
+> checkpoint 批准投递。
+<!-- release-skill:capability:postpublish-presets -->
+
+<!-- release-skill:capability:postverify-stage -->
+> **postVerify 阶段：** 声明 `phase: postVerify` 的 hook 只在主 run 到达
+> VERIFIED 之后执行；`ship` 把它们路由进一个独立的 postVerify run，其 hook
+> 上下文携带验证证据（`verifyEvidence` 仅该阶段存在）。postVerify run 失败
+> 即保持 PARTIAL、可 reconcile，但绝不把主 run 从 VERIFIED 回退——失败在
+> evidence 中显著记录，绝不静默。
+<!-- release-skill:capability:postverify-stage -->
+
 <!-- release-skill:maturity:v0.1-boundary -->
 <!-- release-skill:maturity:boundary -->
 > **安全默认路径：** 推荐 `help → assess → prepare --offline → 人工审阅`。
@@ -180,6 +227,15 @@ ACTOR=your-name
    `requiredPublicFiles`。只有在人工审阅之后才添加项目专属 hook 或 gate：
    编辑 `projectConfig.hooks`，或编辑 `verificationGates` 并把同一个 id 加入
    `selectedGateIds`，然后重新运行绑定 dry-run。配置已存在时跳过。
+   下游 postPublish 引导在确认前同样只读：`setup --discover-downstream`
+   枚举下游候选（git remote、邻近的 marketplace/docs 仓、
+   `artifact-graph.config.yaml`，以及存在时的 foundation profile）；
+   `setup --propose-hooks` 把这些线索转为由 `setupDigest` 绑定的 postPublish
+   hook 声明草案。对已接入的项目，
+   `setup --propose-hooks --write --confirm-setup <digest>` 只追加目标发布
+   单元的 `postPublish.hooks` 段，绝不重新生成或改写配置的任何其他部分
+   （create-once 边界不受影响）。foundation profile 只是提案输入之一，绝不
+   自动生效。
    完整多步流程见 [INSTALL.zh-CN.md](INSTALL.zh-CN.md#首次接入)。
 3. **assess** — 只读就绪评估：
    ```bash
@@ -434,6 +490,51 @@ hooks:
 
 hook 在 `prepare` 调用时运行，命令调用本身即授权执行。gate 是发布校准的受控扩展点（见 `references/02-project-config.md`）。
 
+### postPublish hook
+
+`postPublish.hooks` 声明 `publish` 之后执行的下游投递动作。每个条目要么是命名预设，要么是自定义 command hook，遵守与上文相同的命令规则（可执行文件/参数数组，不是 shell 字符串）。预设收到冻结计划的只读投影；自定义 command hook 在冻结 tag 工作树中执行。`materialize` 钩子是可选的：缺省时，`distribute` 改为把发布单元冻结的 `publicFiles` 映射经 Foundation 托管投影物化——全新载荷根、全量预检、零写入拒绝、完整闭包回滚——计划冻结后绝不重读实时项目配置：
+
+```yaml
+postPublish:
+  materialize:
+    command: [node, scripts/materialize-payload.mjs]
+    cwd: .
+    timeoutMs: 600000
+    outputMarker: "payload dir: "
+  commitIdentity:
+    name: release-bot
+    email: mzdbxqh@example.com
+  hooks:
+    - id: mirror-downstream
+      preset: git-mirror
+      config:
+        target:
+          remoteUrl: https://gitlab.example.internal/team/my-project.git
+          branch: main
+    - id: hub-entry-proposal
+      preset: proposal-inbox
+      phase: postVerify
+      requiresApproval: true
+      config:
+        delivery: git-push
+        target:
+          remoteUrl: https://github.com/example/hub.git
+          branch: main
+    - id: custom-notify
+      command: [node, scripts/notify-downstream.mjs]
+      timeoutMs: 300000
+      envAllowlist: [CI]
+```
+
+`requiresApproval: true` 的 hook 停留在 `AWAITING_APPROVAL`，直到 checkpoint 批准被铸造并消费。批准记录绑定 plan digest 与 hook id，24 小时后过期：
+
+```bash
+release-skill approve --plan "$PLAN_PATH" --hook hub-entry-proposal --actor "$ACTOR" --json
+release-skill ship --root "$PROJECT" --hook-approval "$HOOK_APPROVAL_PATH" --json
+```
+
+对已接入的项目，`setup --discover-downstream` 与 `setup --propose-hooks` 起草这些声明供人工审阅；仅追加的增量流程见上文 setup 步骤与 [INSTALL.zh-CN.md](INSTALL.zh-CN.md#首次接入)。
+
 ## Skills
 
 - `release-help`：环境检查和下一步引导。

package/adapters/claude/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "release-skill",
       "source": "./",
-      "version": "0.6.2",
+      "version": "0.7.0",
       "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
       "author": {
         "name": "广州市风荷科技有限公司"

package/adapters/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.6.2",
+  "version": "0.7.0",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/adapters/claude/bin/error-codes.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "kind": "skill-family.contracts.error-codes",
-  "contractsVersion": "1.5.0",
+  "contractsVersion": "1.7.0",
   "policy": {
     "format": "^SFC[0-9]{4}$",
     "ranges": [

package/adapters/claude/bin/kernel-protocol.json

@@ -4,7 +4,7 @@
   "name": "skill-family.kernel.operation",
   "version": 1,
   "status": "stable",
-  "contractsVersion": "1.5.0",
+  "contractsVersion": "1.7.0",
   "description": "Frozen v1 kernel protocol: request/result envelope, operation lifecycle states, and the operation vocabulary. Extensible only by a new protocol version; v1 content is frozen.",
   "states": ["accepted", "running", "succeeded", "failed", "rejected"],
   "initialStates": ["accepted", "rejected"],

package/adapters/claude/bin/license-texts/Apache-2.0.txt

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/adapters/claude/bin/license-texts/MIT.txt

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) {{YEAR}} {{COPYRIGHT_HOLDER}}
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/adapters/claude/bin/registry.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "kind": "skill-family.contracts.registry",
-  "contractsVersion": "1.5.0",
+  "contractsVersion": "1.7.0",
   "note": "Protocol-name and schema-$id registry. Registration mechanically rejects duplicate protocol name/version (SFC1004) and duplicate $id (SFC1003). This file is the single registration surface; adding an entry is a contracts change.",
   "protocols": [
     {
@@ -27,6 +27,13 @@
       "status": "stable",
       "file": "src/schemas/profile-descriptor.schema.json"
     },
+    {
+      "$id": "https://contracts.skill-family.example/v1/project-profile.json",
+      "object": "project-profile",
+      "dialect": "2020-12",
+      "status": "stable",
+      "file": "src/schemas/project-profile.schema.json"
+    },
     {
       "$id": "https://contracts.skill-family.example/v1/managed-file-lock.json",
       "object": "managed-file-lock",
@@ -166,6 +173,62 @@
       "dialect": "2020-12",
       "status": "stable",
       "file": "src/schemas/structured-scan-policy.schema.json"
+    },
+    {
+      "$id": "https://contracts.skill-family.example/v1/timeout-policy.json",
+      "object": "timeout-policy",
+      "dialect": "2020-12",
+      "status": "stable",
+      "file": "src/schemas/timeout-policy.schema.json"
+    },
+    {
+      "$id": "https://contracts.skill-family.example/v1/watchdog-termination-envelope.json",
+      "object": "watchdog-termination-envelope",
+      "dialect": "2020-12",
+      "status": "stable",
+      "file": "src/schemas/watchdog-termination-envelope.schema.json"
+    },
+    {
+      "$id": "https://contracts.skill-family.example/v1/public-boundary-declaration.json",
+      "object": "public-boundary-declaration",
+      "dialect": "2020-12",
+      "status": "stable",
+      "file": "src/schemas/public-boundary-declaration.schema.json"
+    },
+    {
+      "$id": "https://contracts.skill-family.example/v1/platform-difference-registry.json",
+      "object": "platform-difference-registry",
+      "dialect": "2020-12",
+      "status": "stable",
+      "file": "src/schemas/platform-difference-registry.schema.json"
+    },
+    {
+      "$id": "https://contracts.skill-family.example/v1/observation-scope.json",
+      "object": "observation-scope",
+      "dialect": "2020-12",
+      "status": "stable",
+      "file": "src/schemas/observation-scope.schema.json"
+    },
+    {
+      "$id": "https://contracts.skill-family.example/v1/profile-adoption-declaration.json",
+      "object": "profile-adoption-declaration",
+      "dialect": "2020-12",
+      "status": "stable",
+      "file": "src/schemas/profile-adoption-declaration.schema.json"
+    },
+    {
+      "$id": "https://contracts.skill-family.example/v1/audit-baseline-pin.json",
+      "object": "audit-baseline-pin",
+      "dialect": "2020-12",
+      "status": "stable",
+      "file": "src/schemas/audit-baseline-pin.schema.json"
+    },
+    {
+      "$id": "https://contracts.skill-family.example/v1/token-estimate-record.json",
+      "object": "token-estimate-record",
+      "dialect": "2020-12",
+      "status": "stable",
+      "file": "src/schemas/token-estimate-record.schema.json"
     }
   ],
   "dialects": {