release-skill 0.8.0 → 0.8.1

package/adapters/codex/bin/rules.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "kind": "skill-family.contracts.rules",
-  "contractsVersion": "1.12.0",
+  "contractsVersion": "1.13.0",
   "budget": {
     "firstVersionMax": 20,
     "absoluteMax": 30,

package/adapters/codex/schemas/release-plan.schema.json

@@ -1051,9 +1051,10 @@
     "humanConsumersStrategy": {
       "type": "string",
       "enum": [
-        "manualFollowUps"
+        "manualFollowUps",
+        "foundationPayloadThenManualFollowUps"
       ],
-      "description": "Human consumer strategy marker. 'manualFollowUps': Kimi/CodeBuddy installations are non-blocking post-release manual tasks; verify returns VERIFIED with manualFollowUps list and does not block on attestation. Absent: legacy attestation closed loop (backward compatibility)."
+      "description": "Human consumer strategy marker. 'foundationPayloadThenManualFollowUps': verify first observes the complete frozen plugin through Foundation, then preserves non-blocking Kimi/CodeBuddy marketplace/invocation follow-ups. 'manualFollowUps': legacy 0.8 behavior without the Foundation payload observation. Absent: legacy attestation closed loop."
     },
     "workflowKind": {
       "type": "string",

package/adapters/codex/schemas/release-run.schema.json

@@ -530,7 +530,7 @@
     },
     "manualFollowUps": {
       "type": "array",
-      "description": "Non-blocking manual follow-up tasks for human consumer platforms (Kimi/CodeBuddy) when plan declares humanConsumersStrategy: 'manualFollowUps'",
+      "description": "Non-blocking marketplace installation and invocation follow-ups for Kimi/CodeBuddy. Under foundationPayloadThenManualFollowUps, the frozen payload was observed first but these real-host tasks remain unverified.",
       "items": {
         "type": "object",
         "required": [
@@ -571,6 +571,40 @@
         }
       }
     },
+    "foundationPluginVerificationReceipts": {
+      "type": "array",
+      "description": "Foundation complete-plugin local payload observations bound to verify actions. These receipts do not prove marketplace installation or host invocation.",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "planDigest",
+          "actionId",
+          "unitId",
+          "requestDigest",
+          "hostId",
+          "goal",
+          "sourceType",
+          "foundationStatus",
+          "payloadMatches",
+          "observationDigest",
+          "observedAt"
+        ],
+        "properties": {
+          "planDigest": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+          "actionId": { "type": "string", "minLength": 1 },
+          "unitId": { "type": "string", "minLength": 1 },
+          "requestDigest": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+          "hostId": { "enum": ["kimi-code", "workbuddy"] },
+          "goal": { "const": "install-only" },
+          "sourceType": { "const": "local-staged" },
+          "foundationStatus": { "const": "observed" },
+          "payloadMatches": { "const": true },
+          "observationDigest": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+          "observedAt": { "type": "string", "format": "date-time" }
+        }
+      }
+    },
     "skillResourceClosureReceipts": {
       "type": "array",
       "description": "Per-surface skill resource closure verification receipts from verify phase",

package/adapters/codex/src/schemas/filesystem-tree-observation.schema.json

@@ -0,0 +1,55 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://contracts.skill-family.example/v1/filesystem-tree-observation.json",
+  "title": "Filesystem tree observation",
+  "description": "A complete same-pass fact observation of a bound filesystem tree (FND-DES-014 section 6.1). Private data only: it is returned by the public read-only harness entry, but never enters a public plugin verification result. The record keeps the original root binding so consumers re-verify the same bound root and never re-bind a replacement. Members are canonical relative paths sorted by Unicode code point; directories carry identity/type/permission facts only; file bytes come from the same native descriptor that supplies statMode.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "kind", "rootBinding", "members", "membersDigest"],
+  "properties": {
+    "schemaVersion": { "const": 1 },
+    "kind": { "const": "skill-family.filesystem-tree-observation" },
+    "rootBinding": { "$ref": "https://contracts.skill-family.example/v1/filesystem-root-binding.json" },
+    "members": {
+      "type": "array",
+      "uniqueItems": true,
+      "items": { "$ref": "#/$defs/member" }
+    },
+    "membersDigest": {
+      "type": "string",
+      "pattern": "^[0-9a-f]{64}$"
+    }
+  },
+  "$defs": {
+    "statMode": { "type": "integer", "minimum": 0, "maximum": 65535 },
+    "member": {
+      "oneOf": [
+        { "$ref": "#/$defs/fileMember" },
+        { "$ref": "#/$defs/directoryMember" }
+      ]
+    },
+    "fileMember": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["path", "type", "sha256", "bytes", "statMode", "contentBase64"],
+      "properties": {
+        "path": { "type": "string", "minLength": 1 },
+        "type": { "const": "file" },
+        "sha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
+        "bytes": { "type": "integer", "minimum": 0 },
+        "statMode": { "$ref": "#/$defs/statMode" },
+        "contentBase64": { "type": "string" }
+      }
+    },
+    "directoryMember": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["path", "type", "statMode"],
+      "properties": {
+        "path": { "type": "string", "minLength": 1 },
+        "type": { "const": "directory" },
+        "statMode": { "$ref": "#/$defs/statMode" }
+      }
+    }
+  }
+}

package/adapters/codex/src/schemas/host-verification-result.schema.json

@@ -103,8 +103,8 @@
         "spawned": { "type": "boolean" },
         "exitStatus": { "type": ["integer", "null"], "minimum": 0 },
         "processStatus": { "type": ["string", "null"], "enum": ["PLANNED", "STARTING", "RUNNING", "EXITED", "FAILED_TO_START", "TIMED_OUT", "TERMINATED", null] },
-        "terminationReason": { "$ref": "https://contracts.skill-family.example/v1/watchdog-termination-envelope.json#/properties/terminationReason" },
-        "watchdogReason": { "$ref": "https://contracts.skill-family.example/v1/watchdog-termination-envelope.json#/properties/watchdogReason" },
+        "terminationReason": { "$ref": "https://contracts.skill-family.example/v1/watchdog-termination-envelope.json#/properties/terminationReason", "not": { "const": "output_limit_exceeded" } },
+        "watchdogReason": { "$ref": "https://contracts.skill-family.example/v1/watchdog-termination-envelope.json#/properties/watchdogReason", "not": { "const": "output_limit_exceeded" } },
         "runnerModelOverrideAbsent": { "type": "boolean" }
       }
     },

package/adapters/codex/src/schemas/plugin-verification-request.schema.json

@@ -0,0 +1,374 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://contracts.skill-family.example/v1/plugin-verification-request.json",
+  "title": "Plugin verification request",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion",
+    "kind",
+    "operation",
+    "verificationSetId",
+    "goal",
+    "source",
+    "host",
+    "install"
+  ],
+  "properties": {
+    "schemaVersion": {
+      "const": 1
+    },
+    "kind": {
+      "const": "skill-family.plugin-verification-request"
+    },
+    "operation": {
+      "const": "plugin-verification"
+    },
+    "verificationSetId": {
+      "$ref": "https://contracts.skill-family.example/v1/host-verification-request.json#/$defs/opaque"
+    },
+    "goal": {
+      "enum": [
+        "install-only",
+        "install-and-invoke"
+      ]
+    },
+    "source": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "type",
+        "candidateRef",
+        "sourceManifestSha256",
+        "membersDigest"
+      ],
+      "properties": {
+        "type": {
+          "enum": [
+            "local-staged",
+            "public-channel"
+          ]
+        },
+        "candidateRef": {
+          "$ref": "https://contracts.skill-family.example/v1/host-verification-request.json#/$defs/opaque"
+        },
+        "sourceManifestSha256": {
+          "$ref": "https://contracts.skill-family.example/v1/host-verification-request.json#/$defs/sha256"
+        },
+        "membersDigest": {
+          "$ref": "https://contracts.skill-family.example/v1/host-verification-request.json#/$defs/sha256"
+        },
+        "channel": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "marketplaceId",
+            "pluginId",
+            "version",
+            "sourceRef",
+            "locatorSha256"
+          ],
+          "properties": {
+            "marketplaceId": {
+              "$ref": "https://contracts.skill-family.example/v1/host-verification-request.json#/$defs/opaque"
+            },
+            "pluginId": {
+              "$ref": "https://contracts.skill-family.example/v1/host-verification-request.json#/$defs/opaque"
+            },
+            "version": {
+              "$ref": "https://contracts.skill-family.example/v1/host-verification-request.json#/$defs/host/properties/driverVersion"
+            },
+            "sourceRef": {
+              "$ref": "https://contracts.skill-family.example/v1/host-verification-request.json#/$defs/opaque"
+            },
+            "locatorSha256": {
+              "$ref": "https://contracts.skill-family.example/v1/host-verification-request.json#/$defs/sha256"
+            }
+          }
+        }
+      }
+    },
+    "host": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "hostId",
+        "descriptorSha256",
+        "driverId",
+        "driverVersion"
+      ],
+      "properties": {
+        "hostId": {
+          "$ref": "https://contracts.skill-family.example/v1/host-verification-request.json#/$defs/host/properties/hostId"
+        },
+        "descriptorSha256": {
+          "$ref": "https://contracts.skill-family.example/v1/host-verification-request.json#/$defs/sha256"
+        },
+        "driverId": {
+          "$ref": "https://contracts.skill-family.example/v1/host-verification-request.json#/$defs/host/properties/driverId"
+        },
+        "driverVersion": {
+          "$ref": "https://contracts.skill-family.example/v1/host-verification-request.json#/$defs/host/properties/driverVersion"
+        },
+        "cliVersion": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 256
+        },
+        "executableSha256": {
+          "$ref": "https://contracts.skill-family.example/v1/host-verification-request.json#/$defs/sha256"
+        }
+      }
+    },
+    "install": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "mode"
+      ],
+      "properties": {
+        "mode": {
+          "const": "fresh-tree"
+        },
+        "timeoutPolicy": {
+          "$ref": "https://contracts.skill-family.example/v1/timeout-policy.json"
+        },
+        "outputByteLimits": {
+          "$ref": "https://contracts.skill-family.example/v1/watchdog-termination-envelope.json#/$defs/outputByteLimits"
+        }
+      }
+    },
+    "auth": {
+      "$ref": "https://contracts.skill-family.example/v1/host-verification-request.json#/properties/auth"
+    },
+    "invocation": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "effectivePromptSha256",
+        "fixtureClosureDigest",
+        "protectedWorkspaceClosureDigest",
+        "timeoutPolicy",
+        "modelOverridePolicy",
+        "restrictions"
+      ],
+      "properties": {
+        "effectivePromptSha256": {
+          "$ref": "https://contracts.skill-family.example/v1/host-verification-request.json#/$defs/sha256"
+        },
+        "fixtureClosureDigest": {
+          "$ref": "https://contracts.skill-family.example/v1/host-verification-request.json#/$defs/sha256"
+        },
+        "protectedWorkspaceClosureDigest": {
+          "$ref": "https://contracts.skill-family.example/v1/host-verification-request.json#/$defs/sha256"
+        },
+        "timeoutPolicy": {
+          "$ref": "https://contracts.skill-family.example/v1/timeout-policy.json"
+        },
+        "modelOverridePolicy": {
+          "const": "forbidden"
+        },
+        "restrictions": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "approvalPolicy": {
+              "const": "deny-unattended"
+            },
+            "tools": {
+              "const": "skill-only"
+            },
+            "mcp": {
+              "const": "disabled"
+            },
+            "settingsSources": {
+              "const": "empty"
+            },
+            "sessionPersistence": {
+              "const": "disabled"
+            },
+            "history": {
+              "const": "fresh"
+            },
+            "browserIntegration": {
+              "const": "disabled"
+            },
+            "maxTurns": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 100
+            },
+            "maxBudgetUsd": {
+              "type": "number",
+              "exclusiveMinimum": 0,
+              "maximum": 100
+            }
+          }
+        }
+      }
+    }
+  },
+  "allOf": [
+    {
+      "if": {
+        "type": "object",
+        "properties": {
+          "goal": {
+            "const": "install-and-invoke"
+          }
+        },
+        "required": [
+          "goal"
+        ]
+      },
+      "then": {
+        "type": "object",
+        "required": [
+          "invocation"
+        ],
+        "properties": {
+          "invocation": {}
+        }
+      },
+      "else": {
+        "type": "object",
+        "properties": {
+          "invocation": false
+        }
+      }
+    },
+    {
+      "if": {
+        "type": "object",
+        "properties": {
+          "source": {
+            "type": "object",
+            "properties": {
+              "type": {
+                "const": "public-channel"
+              }
+            },
+            "required": [
+              "type"
+            ]
+          }
+        },
+        "required": [
+          "source"
+        ]
+      },
+      "then": {
+        "type": "object",
+        "properties": {
+          "source": {
+            "type": "object",
+            "properties": {
+              "channel": {
+                "type": "object"
+              }
+            },
+            "required": [
+              "channel"
+            ]
+          },
+          "install": {
+            "type": "object",
+            "properties": {
+              "timeoutPolicy": {}
+            },
+            "required": [
+              "timeoutPolicy"
+            ]
+          }
+        }
+      },
+      "else": {
+        "type": "object",
+        "properties": {
+          "source": {
+            "type": "object",
+            "properties": {
+              "channel": false
+            }
+          },
+          "install": {
+            "type": "object",
+            "properties": {
+              "timeoutPolicy": false,
+              "outputByteLimits": false
+            }
+          }
+        }
+      }
+    },
+    {
+      "if": {
+        "anyOf": [
+          {
+            "type": "object",
+            "properties": {
+              "goal": {
+                "const": "install-and-invoke"
+              }
+            },
+            "required": [
+              "goal"
+            ]
+          },
+          {
+            "type": "object",
+            "properties": {
+              "source": {
+                "type": "object",
+                "properties": {
+                  "type": {
+                    "const": "public-channel"
+                  }
+                },
+                "required": [
+                  "type"
+                ]
+              }
+            },
+            "required": [
+              "source"
+            ]
+          }
+        ]
+      },
+      "then": {
+        "type": "object",
+        "required": [
+          "auth"
+        ],
+        "properties": {
+          "auth": {},
+          "host": {
+            "type": "object",
+            "properties": {
+              "cliVersion": {},
+              "executableSha256": {}
+            },
+            "required": [
+              "cliVersion",
+              "executableSha256"
+            ]
+          }
+        }
+      },
+      "else": {
+        "type": "object",
+        "properties": {
+          "auth": false,
+          "host": {
+            "type": "object",
+            "properties": {
+              "cliVersion": false,
+              "executableSha256": false
+            }
+          }
+        }
+      }
+    }
+  ]
+}