release-skill 0.9.16 → 0.9.17

package/adapters/kimi/schemas/release-plan.schema.json

@@ -1624,7 +1624,7 @@
           "type": "array",
           "minItems": 1,
           "uniqueItems": true,
-          "items": { "type": "string", "enum": ["claude", "codex", "kimi", "codebuddy", "workbuddy"] }
+          "items": { "type": "string", "enum": ["claude", "codex", "kimi", "codebuddy", "workbuddy", "qoder"] }
         },
         "hub": { "$ref": "#/definitions/planLocalHostHub" }
       }

package/adapters/kimi/schemas/release-project.schema.json

@@ -1053,7 +1053,7 @@
           "type": "array",
           "minItems": 1,
           "uniqueItems": true,
-          "items": { "type": "string", "enum": ["claude", "codex", "kimi", "codebuddy", "workbuddy"] }
+          "items": { "type": "string", "enum": ["claude", "codex", "kimi", "codebuddy", "workbuddy", "qoder"] }
         },
         "hub": { "$ref": "#/definitions/localHostHub" }
       }

package/adapters/kimi/skills/release-finish/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: release-finish
-description: 发布达到 VERIFIED 后处理发布收尾：确认 postVerify 提案送达边界，按发布分支策略决定是否询问合并，并在用户确认后更新本机 Claude、Codex、Kimi、CodeBuddy/WorkBuddy 插件
+description: 发布达到 VERIFIED 后处理发布收尾：确认 postVerify 提案送达边界，按发布分支策略决定是否询问合并，并在用户确认后更新本机 Claude、Codex、Kimi、CodeBuddy/WorkBuddy、Qoder 插件
 ---
 
 > **Kimi Code 安装入口解析协议**：Kimi Code 官方技能契约提供正文占位符 `${KIMI_SKILL_DIR}`，宿主在向 Agent 发送正文前会将其展开为当前 `SKILL.md` 所在目录的绝对路径。必须把展开后的字面量作为当前技能目录的唯一权威输入，记为 `SKILL_DIR`。
@@ -20,7 +20,7 @@ description: 发布达到 VERIFIED 后处理发布收尾：确认 postVerify 提
 
 这是发布后的独立收尾，不属于 `prepare → approve → publish → verify` 状态机。它不能把本机更新结果写成新的发布状态，也不能因为本机更新失败而降低 `VERIFIED`。
 
-默认只读取冻结计划和 verify 或 postVerify run。没有用户明确同意，不合并分支，不更新插件。Kimi 只在插件信任界面中的仓库和标签都与冻结目标一致时确认安装；目录信任不自动确认。
+默认只读取冻结计划和 verify 或 postVerify run。没有用户明确同意，不合并分支，不更新插件。用户显式选择 Kimi 更新后，只有标准初始目录信任界面和插件信任界面中的冻结身份都通过核对，才确认当前项目并安装。用户显式选择 Qoder 且冻结计划声明该宿主后，才执行计划绑定的 Hub 更新。
 
 ## 先生成收尾清单
 
@@ -42,7 +42,7 @@ node "$RELEASE_SKILL_LOCAL_FINISH_ENTRY" \
 
 1. `merge.promptRequired=false` 时，发布工作流已经推进或初始化目标分支，不再询问合并。
 2. `merge.promptRequired=true` 时，向用户说明尚未覆盖的发布分支，并询问是否需要合并。用户同意后，先只读核对源分支、目标分支、工作区状态和项目既有合并方式，再用明确的分支名执行；本脚本不猜分支，也不自动推送。
-3. `localHostUpdate.promptRequired=true` 时，列出计划覆盖的宿主，询问是否更新本机插件。Hub-backed 目标必须显示其声明的 Hub、插件和宿主，并明确这是人工安装/升级入口，不运行本机命令；Claude/Codex 使用现有 marketplace 管理入口，Kimi 使用冻结 GitHub Release 和现有人工确认路径，CodeBuddy/WorkBuddy 明确人工处理且不能固定 Hub ref。后续“用户同意更新”段仅适用于 `available=true` 的 executable externalActions 目标；Hub-backed 始终人工入口。两个问题可以一次问完。
+3. `localHostUpdate.promptRequired=true` 时，列出计划覆盖的宿主，询问是否更新本机插件。Hub-backed 目标必须显示其声明的 Hub、插件和宿主。Qoder 是其中唯一可执行的 Hub-backed 目标；Claude/Codex 使用现有 marketplace 管理入口，Kimi 使用冻结 GitHub Release 和现有人工确认路径，CodeBuddy/WorkBuddy 明确人工处理且不能固定 Hub ref。后续“用户同意更新”段适用于 `available=true` 的 executable externalActions 目标和 Qoder Hub 目标，其余 Hub-backed 目标仍为人工入口。两个问题可以一次问完。
 
 ## postVerify 提案送达边界
 
@@ -62,7 +62,7 @@ node "$RELEASE_SKILL_LOCAL_FINISH_ENTRY" \
   --plan <plan-path> \
   --run <verify-or-postverify-run-path> \
   --update-local-hosts \
-  --hosts claude,codex,kimi,codebuddy,workbuddy \
+  --hosts claude,codex,kimi,codebuddy,workbuddy,qoder \
   --confirm-plan <planDigest> \
   --json
 ```
@@ -70,12 +70,13 @@ node "$RELEASE_SKILL_LOCAL_FINISH_ENTRY" \
 只传用户选择且计划声明的宿主。宿主 CLI 不存在时返回 `SKIPPED_NOT_INSTALLED`。各宿主按以下规则处理：
 
 - Claude 或 Codex 只有在市场需要重绑时，才会在该宿主第一条写命令之前只读查询冻结的市场仓库、引用和提交。远端不可达、引用缺失或提交不一致时返回 `MANUAL_REQUIRED`，该宿主不执行市场或插件写入；其他已选宿主继续处理。精确当前安装仍核对真实载荷，但不强制联网。
-- Kimi 的精确当前安装会在返回 `ALREADY_CURRENT` 前核对真实载荷；发生安装或迁移时，只在操作完成后核对结果。配置根依次取显式 `kimiHome`、`KIMI_CODE_HOME`、用户主目录下的 `.kimi-code`，TUI 与安装后观察使用同一根。release-finish 当前只采用并验证 Kimi Code 的受控终端交互界面（TUI）路径：清理 ANSI/OSC 控制序列和软换行后，在插件信任对话框内分别核对冻结仓库与标签，确认选中 `Trust and install` 后才提交，再重新加载。出现 `Trust this folder?`、未知界面、超时、提前退出，或无法确认身份和选中项时返回 `MANUAL_REQUIRED` 或失败结果，不确认目录信任，也不继续安装。包名、版本、发布标签、已安装修订号和受管安装根必须与冻结计划一致；`.git` 只提供附加诊断，不是通过条件。旧的本地路径安装会在同一 TUI 会话中先移除，再按发布标签安装。
+- Kimi 的精确当前安装会在返回 `ALREADY_CURRENT` 前核对真实载荷；发生安装或迁移时，只在操作完成后核对结果。配置根依次取显式 `kimiHome`、`KIMI_CODE_HOME`、用户主目录下的 `.kimi-code`，TUI 与安装后观察使用同一根。release-finish 当前只采用并验证 Kimi Code 的受控终端交互界面（TUI）路径，并把 TUI 工作目录固定为 `--root` 指定的当前发布项目。用户已确认冻结计划、显式选择更新且 `--hosts` 包含 `kimi` 时，流程只在初始标准 `Trust this folder?` 界面确认目录：先核对当前选中 `No, exit` 和目标 `Trust this folder`，移动并重新核对目标选中项，确认后等待已知命令提示符。插件命令发出后再次出现目录信任、界面或选中项未知、移动后无法确认、超时或提前退出时，该宿主失败并停止后续安装步骤。插件信任仍先清理 ANSI/OSC 控制序列和软换行，再分别核对冻结仓库与标签；只有选中 `Trust and install` 才提交并重新加载。包名、版本、发布标签、已安装修订号和受管安装根必须与冻结计划一致；`.git` 只提供附加诊断，不是通过条件。旧的本地路径安装会在同一 TUI 会话中先移除，再按发布标签安装。
 - CodeBuddy/WorkBuddy 只处理同一 bundled-family 插件和市场。CodeBuddy 仅探测全局 `codebuddy`/`cbc`，由收尾脚本把 `CODEBUDDY_CONFIG_DIR` 固定为有效 `HOME`（环境未提供时取操作系统用户主目录）下名为 `.codebuddy` 的目录；WorkBuddy 仅在 macOS 探测 WorkBuddy 应用内嵌 CLI，由收尾脚本把 `CODEBUDDY_CONFIG_DIR` 与 `WORKBUDDY_CONFIG_DIR` 同时固定为有效 `HOME` 下名为 `.workbuddy` 的目录，绝不把两者互作回退。只有冻结标签与计划声明的可变分支都从同一远端解析到冻结提交时，才调用正式市场更新和插件更新命令；完成后重新读取安装列表，并精确核对唯一条目的市场、版本和修订号。目标未安装、来源不符、远端不可访问或身份不一致时返回 `MANUAL_REQUIRED`，不修改宿主。非 macOS 的 WorkBuddy 返回 `SKIPPED_UNSUPPORTED_PLATFORM`。
+- Qoder 先用 `qoder plugins marketplace list --json` 核对计划声明的 Hub 名称、仓库、分支和本机 checkout，再用 `qoder plugins list --json` 核对唯一插件条目的市场、`scope=user`、版本与 `installPath`。目标市场或插件未安装时返回 `MANUAL_REQUIRED`，不添加市场，也不执行首次安装。旧版已安装时，只运行 `qoder plugins marketplace update <name>` 和 `qoder plugins update <plugin@marketplace> --scope user`。市场刷新后、插件更新前，必须从 Hub 的 `marketplace.json` 核对目标条目的 `source.url` 和 `source.sha`；操作后从真实 `installPath` 核对 Qoder manifest、完整声明载荷和冻结来源。市场可能在检查与更新之间变化，事后身份不符时报告失败，不自动降级、卸载或覆盖。
 
 任何宿主失败都保留其他宿主的实际结果，不回滚，也不把失败冒充成功。
 
-完成后报告每个宿主的状态，并提醒用户重启已更新的宿主。本机结果只记录收尾事实，不改变发布状态。
+完成后报告每个宿主的安装状态。Qoder 返回 `UPDATED` 只表示安装载荷已经更新；启动新会话或执行 `/plugins reload` 并核对实际加载版本后，才能报告新版已加载。本机结果只记录收尾事实，不改变发布状态。
 
 ## 配置与目录
 
@@ -83,8 +84,8 @@ node "$RELEASE_SKILL_LOCAL_FINISH_ENTRY" \
 文件缺失或无法解析时，报告具体配置问题，不猜默认分支或 setup，也不得把文件缺失当作字段合法缺省；
 已经取得的发布结果仍保留。只有配置文件有效时，整个 `releaseFinish` 或其中字段缺省才按各自合同默认。
 
-发布项目目录用于读取配置和执行源码 Git 检查。setup 使用用户明确指定的消费项目目录或已明确的使用
-上下文。只有用户明确把发布源码仓库作为消费项目时，才能在那里执行 setup；同时提供两个目录时不得混用。
+发布项目目录用于读取配置、执行源码 Git 检查和调用 setup。`--root <project-root>` 指定的目录也是 setup
+的目标目录；不再接收或询问另一个项目路径。
 
 ## 更新后 setup
 
@@ -96,17 +97,17 @@ node "$RELEASE_SKILL_LOCAL_FINISH_ENTRY" \
 元数据核对目标插件身份、版本和入口；不能从开发仓库、旧会话缓存或同名技能推断新版已加载。当前宿主
 不满足时，可以使用同次更新中另一个已安装并加载目标版本和入口的宿主。
 
-目标目录来自用户本次明确指定的消费项目或已明确的使用上下文。目录不明确、宿主需要重启、当前环境
-不能调用可用宿主、入口不存在或归属有歧义时，标为“待执行”，并给出插件与版本、技能名、目标目录和
-已有授权的续接提示。发出提示不代表 setup 已完成。
+setup 的目标目录固定为当前发布项目根目录。宿主需要重启、当前环境不能调用可用宿主、入口不存在或
+归属有歧义时，标为“待执行”，并给出插件与版本、技能名、当前项目路径和已有授权的续接提示。发出提示
+不代表 setup 已完成。
 
 对同一插件版本、同一项目目录和相同共享运行环境，项目级依赖、项目配置和 Git hooks 由一个已加载
 新版插件的宿主检查一次。其余宿主分别核对自身安装、加载和宿主专属配置。不同运行环境不得无条件
 复用项目就绪结论；按目标 setup 的实际合同补查差异。release-finish 不保存去重键、收据或新的状态。
 
-调用 setup 前完整读取目标技能及其必读引用，并传入目标项目、插件版本、只读检查意图和已有授权范围。
+调用 setup 前完整读取目标技能及其必读引用，并传入当前发布项目、插件版本、只读检查意图和已有授权范围。
 已有具体修复授权应传递给 setup；未覆盖的写入不能执行。只读检查、安装结果和配置修复结果分别报告。
-最终自然语言回复列出执行宿主、插件版本、消费项目路径、实际结果和未完成项。任何 setup 结果都不改变
+最终自然语言回复列出执行宿主、插件版本、当前项目路径、实际结果和未完成项。任何 setup 结果都不改变
 `VERIFIED`，也不影响其他宿主已经完成的结果。
 
 ## 源码分支检查

package/adapters/kimi/skills/release-help/SKILL.md

@@ -24,15 +24,15 @@ description: "Discoverable entry point for release-skill: dependency and environ
 - 只读诊断：运行 dry-run 检查，不修改任何文件
 - 故障引导：根据错误码指向对应的修复 Skill
 
-## 0.9.5 候选边界
+## 0.9.17 候选边界
 
 当前源码候选允许多发布单元项目在计划冻结前显式选择本轮范围。`prepare` 和新建的 `ship` 状态支持重复传入 `--unit <id>`；未传时继续选择全部配置单元。成功选择会列出选中与延期单元。延期单元不进入本轮计划，也不获得发布状态。
 
 选择只影响按单元绑定的检查与动作。完整配置、生成物新鲜度和顶层 Hook 仍覆盖整个项目。`publicSourceAuthorityReceipt` 涉及的 coordinator 和 subjects 必须作为完整闭包共同选择，系统不会自动扩选。计划冻结后，`plan.units` 是唯一范围权威；publish、reconcile、verify 和 distribute 不接受 `--unit`。
 
-0.9.3 引入的四项工作流保护、Hook cache v2 和稳定隔离安装树记录在 0.9.4 继续保留。0.9.4 精确消费 Foundation 0.16.0 的公开包根 API。Hook cache 只复用绝对路径或经真实 cwd 校验的 cwd-relative executable identity；裸 PATH、PATHEXT、Windows 和观察不可用时，Hook 仍冷执行，缓存复用失败关闭且不写入 v2 cache。缓存没有 TTL。
+0.9.3 引入的四项工作流保护、Hook cache v2 和稳定隔离安装树记录在后续版本继续保留。当前 0.9.17 候选精确消费 Foundation 0.17.0 的公开包根 API。Hook cache 只复用绝对路径或经真实 cwd 校验的 cwd-relative executable identity；裸 PATH、PATHEXT、Windows 和观察不可用时，Hook 仍冷执行，缓存复用失败关闭且不写入 v2 cache。缓存没有 TTL。
 
-稳定隔离安装树记录只在宿主命令退出、目录已隔离且扫描期间没有并发写入时执行；宿主附加链接只记录、不跟随，声明载荷中的 symlink 失败关闭，legacy 全树语义保持不变。0.9.5 仍是源码候选，不能从本说明推断已批准、发布或验证。
+稳定隔离安装树记录只在宿主命令退出、目录已隔离且扫描期间没有并发写入时执行；宿主附加链接只记录、不跟随，声明载荷中的 symlink 失败关闭，legacy 全树语义保持不变。0.9.17 仍是源码候选，不能从本说明推断已批准、发布或验证。
 
 **阶段通过规则**: `status` 与 `readiness.localPreparation.status` 只判断本地 help/assess/prepare；其充要条件是 `READY` 且 exit code 为 0。`missingRequired` 列出缺失的 Node/Git。生产发布必须另外读取 `readiness.productionPublish`：缺少 npm/gh 时为 `NOT_READY`，依赖存在时仍是 `AUTH_CHECK_REQUIRED`，因为 help 不访问网络、不验证认证。Agent 无权把本地就绪解释为生产就绪。
 

package/adapters/kimi/skills/release-verify/SKILL.md

@@ -29,9 +29,9 @@ ship state；hook approval 缺失、错误或过期时，在 hook 执行前失
 
 **注意**: distribute gate (W1) 已经实现并集成在标准 verify 流程中。verify 现在会检查 postPublish 分发状态（git mirror + marketplace index），只有当所有外部动作都完成并通过验证时才达到 VERIFIED。
 
-**工作流兼容性**: 
+**工作流兼容性**:
 - `docs-only`: consumer-verify preserved (步骤⑧)
-- `config-only`: scene B completes full chain including verify  
+- `config-only`: scene B completes full chain including verify
 - `marketplace-only`: delegates to workspace's exclusive skill for final verification
 - `full-happy-end`: standard complete path with all gates
 

package/adapters/qoder/.qoder-plugin/plugin.json

@@ -0,0 +1,10 @@
+{
+  "name": "release-skill",
+  "version": "0.9.17",
+  "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
+  "author": {
+    "name": "广州市风荷科技有限公司"
+  },
+  "license": "Apache-2.0",
+  "skills": "./skills/"
+}

package/adapters/qoder/bin/consumer-contract-vectors.json

@@ -0,0 +1,110 @@
+{
+  "schemaVersion": 1,
+  "kind": "skill-family.contracts.consumer-contract-vectors",
+  "foundationVersion": "0.17.0",
+  "sets": [
+    {
+      "capabilityId": "foundation.contracts.object-validation",
+      "vectorSetId": "foundation.contracts.object-validation.consumer-v1",
+      "contractId": "skill-family-contracts:validateDocument",
+      "strategy": "real-pure",
+      "vectors": [
+        {
+          "schemaVersion": 1,
+          "kind": "skill-family.consumer-contract-vector",
+          "vectorId": "foundation.contracts.object-validation.consumer-v1.indeterminate",
+          "vectorSetId": "foundation.contracts.object-validation.consumer-v1",
+          "capabilityId": "foundation.contracts.object-validation",
+          "foundationVersion": "0.17.0",
+          "contractId": "skill-family-contracts:validateDocument",
+          "caseClass": "indeterminate",
+          "strategy": "real-pure",
+          "request": {
+            "document": { "schemaVersion": 1, "kind": "skill-family.project-manifest" },
+            "options": { "schemaId": "https://contracts.skill-family.example/v1/project-manifest.json", "dialect": "2020-12", "policy": "strict" }
+          },
+          "expected": { "outcome": "indeterminate", "allowedStates": ["return", "throw"], "failClosed": true }
+        },
+        {
+          "schemaVersion": 1,
+          "kind": "skill-family.consumer-contract-vector",
+          "vectorId": "foundation.contracts.object-validation.consumer-v1.negative",
+          "vectorSetId": "foundation.contracts.object-validation.consumer-v1",
+          "capabilityId": "foundation.contracts.object-validation",
+          "foundationVersion": "0.17.0",
+          "contractId": "skill-family-contracts:validateDocument",
+          "caseClass": "negative",
+          "strategy": "real-pure",
+          "request": {
+            "document": { "schemaVersion": 1, "kind": "skill-family.project-manifest", "project": { "id": "demo-project", "name": "Demo Project" }, "contracts": { "version": "not-a-version", "profile": "generic" } },
+            "options": { "schemaId": "https://contracts.skill-family.example/v1/project-manifest.json", "dialect": "2020-12", "policy": "strict" }
+          },
+          "expected": { "outcome": "return", "value": { "valid": false, "errorCode": "SFC1001", "errors": [{ "keyword": "pattern", "instancePath": "/contracts/version", "schemaPath": "#/properties/contracts/properties/version/pattern", "message": "must match pattern \"^[0-9]+\\.[0-9]+\\.[0-9]+$\"", "params": { "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$" } }], "data": { "schemaVersion": 1, "kind": "skill-family.project-manifest", "project": { "id": "demo-project", "name": "Demo Project" }, "contracts": { "version": "not-a-version", "profile": "generic" } } } }
+        },
+        {
+          "schemaVersion": 1,
+          "kind": "skill-family.consumer-contract-vector",
+          "vectorId": "foundation.contracts.object-validation.consumer-v1.positive",
+          "vectorSetId": "foundation.contracts.object-validation.consumer-v1",
+          "capabilityId": "foundation.contracts.object-validation",
+          "foundationVersion": "0.17.0",
+          "contractId": "skill-family-contracts:validateDocument",
+          "caseClass": "positive",
+          "strategy": "real-pure",
+          "request": {
+            "document": { "schemaVersion": 1, "kind": "skill-family.project-manifest", "project": { "id": "demo-project", "name": "Demo Project" }, "contracts": { "version": "1.0.0", "profile": "generic" } },
+            "options": { "schemaId": "https://contracts.skill-family.example/v1/project-manifest.json", "dialect": "2020-12", "policy": "strict" }
+          },
+          "expected": { "outcome": "return", "value": { "valid": true, "errorCode": null, "errors": [], "data": { "schemaVersion": 1, "kind": "skill-family.project-manifest", "project": { "id": "demo-project", "name": "Demo Project" }, "contracts": { "version": "1.0.0", "profile": "generic" } } } }
+        }
+      ]
+    },
+    {
+      "capabilityId": "foundation.harness.atomic-write",
+      "vectorSetId": "foundation.harness.atomic-write.consumer-v1",
+      "contractId": "skill-family-harness-node:writeFileAtomic",
+      "strategy": "official-fake",
+      "vectors": [
+        {
+          "schemaVersion": 1,
+          "kind": "skill-family.consumer-contract-vector",
+          "vectorId": "foundation.harness.atomic-write.consumer-v1.indeterminate",
+          "vectorSetId": "foundation.harness.atomic-write.consumer-v1",
+          "capabilityId": "foundation.harness.atomic-write",
+          "foundationVersion": "0.17.0",
+          "contractId": "skill-family-harness-node:writeFileAtomic",
+          "caseClass": "indeterminate",
+          "strategy": "official-fake",
+          "request": { "root": { "runtimeBinding": "atomic-write-canonical-root" }, "relPath": "records/item.json", "data": "fixture-data", "options": { "mode": 420 } },
+          "expected": { "outcome": "indeterminate", "allowedStates": ["return", "throw"], "failClosed": true }
+        },
+        {
+          "schemaVersion": 1,
+          "kind": "skill-family.consumer-contract-vector",
+          "vectorId": "foundation.harness.atomic-write.consumer-v1.negative",
+          "vectorSetId": "foundation.harness.atomic-write.consumer-v1",
+          "capabilityId": "foundation.harness.atomic-write",
+          "foundationVersion": "0.17.0",
+          "contractId": "skill-family-harness-node:writeFileAtomic",
+          "caseClass": "negative",
+          "strategy": "official-fake",
+          "request": { "root": { "runtimeBinding": "atomic-write-canonical-root" }, "relPath": "../outside.json", "data": "fixture-data", "options": { "mode": 420 } },
+          "expected": { "outcome": "throw", "errorCode": "SFC2004", "errorKind": "path-traversal" }
+        },
+        {
+          "schemaVersion": 1,
+          "kind": "skill-family.consumer-contract-vector",
+          "vectorId": "foundation.harness.atomic-write.consumer-v1.positive",
+          "vectorSetId": "foundation.harness.atomic-write.consumer-v1",
+          "capabilityId": "foundation.harness.atomic-write",
+          "foundationVersion": "0.17.0",
+          "contractId": "skill-family-harness-node:writeFileAtomic",
+          "caseClass": "positive",
+          "strategy": "official-fake",
+          "request": { "root": { "runtimeBinding": "atomic-write-canonical-root" }, "relPath": "records/item.json", "data": "fixture-data", "options": { "mode": 420 } },
+          "expected": { "outcome": "return", "valueRelation": "atomic-write-contained-absolute-target" }
+        }
+      ]
+    }
+  ]
+}

package/adapters/qoder/bin/error-codes.json

@@ -0,0 +1,161 @@
+{
+  "schemaVersion": 1,
+  "kind": "skill-family.contracts.error-codes",
+  "contractsVersion": "1.16.0",
+  "policy": {
+    "format": "^SFC[0-9]{4}$",
+    "ranges": [
+      {
+        "prefix": "SFC1",
+        "category": "contract",
+        "note": "Contracts authority errors: schemas, registry, dialects, rules, fixtures."
+      },
+      {
+        "prefix": "SFC2",
+        "category": "kernel",
+        "note": "Kernel protocol operation errors."
+      },
+      {
+        "prefix": "SFC3",
+        "category": "report",
+        "note": "Report contract errors: digest binding, mandatory elements, fact drift. Style findings are never coded here; they are advisory output of the report check, not errors."
+      }
+    ],
+    "stability": "Codes are append-only. A frozen code is never reused for a different meaning; a deprecated code stays reserved. New codes require a contracts change."
+  },
+  "codes": [
+    {
+      "code": "SFC1001",
+      "name": "SCHEMA_VALIDATION_FAILED",
+      "category": "contract",
+      "stableSince": "1.0.0",
+      "meaning": "A document failed validation against its registered schema under the declared dialect and policy."
+    },
+    {
+      "code": "SFC1002",
+      "name": "UNKNOWN_SCHEMA_ID",
+      "category": "contract",
+      "stableSince": "1.0.0",
+      "meaning": "The referenced $id is not present in the schema registry."
+    },
+    {
+      "code": "SFC1003",
+      "name": "DUPLICATE_SCHEMA_ID",
+      "category": "contract",
+      "stableSince": "1.0.0",
+      "meaning": "Two schema registrations share the same $id; the registration is mechanically rejected."
+    },
+    {
+      "code": "SFC1004",
+      "name": "DUPLICATE_PROTOCOL_NAME",
+      "category": "contract",
+      "stableSince": "1.0.0",
+      "meaning": "Two protocol registrations share the same name and version; the registration is mechanically rejected."
+    },
+    {
+      "code": "SFC1005",
+      "name": "UNRESOLVED_REF",
+      "category": "contract",
+      "stableSince": "1.0.0",
+      "meaning": "A $ref target cannot be resolved within the registered schema set."
+    },
+    {
+      "code": "SFC1006",
+      "name": "UNSUPPORTED_DIALECT",
+      "category": "contract",
+      "stableSince": "1.0.0",
+      "meaning": "The declared JSON Schema dialect is not in the frozen supported dialect set."
+    },
+    {
+      "code": "SFC1007",
+      "name": "UNKNOWN_CHECK_TYPE",
+      "category": "contract",
+      "stableSince": "1.0.0",
+      "meaning": "A rule uses a check type outside the finite set of nine."
+    },
+    {
+      "code": "SFC1008",
+      "name": "RULE_BUDGET_EXCEEDED",
+      "category": "contract",
+      "stableSince": "1.0.0",
+      "meaning": "The mandatory rule count exceeds the first-version budget or the absolute cap."
+    },
+    {
+      "code": "SFC1009",
+      "name": "UNKNOWN_ERROR_CODE",
+      "category": "contract",
+      "stableSince": "1.0.0",
+      "meaning": "A fixture expectation references an error code that is not in this frozen registry."
+    },
+    {
+      "code": "SFC1010",
+      "name": "FIXTURE_EXPECTATION_MISMATCH",
+      "category": "contract",
+      "stableSince": "1.0.0",
+      "meaning": "A fixture did not behave as declared: a valid-expecting fixture failed, or an invalid-expecting fixture did not fail with the declared stable code."
+    },
+    {
+      "code": "SFC1011",
+      "name": "UNKNOWN_PROTOCOL",
+      "category": "contract",
+      "stableSince": "1.0.0",
+      "meaning": "A request references a protocol name/version that is not registered."
+    },
+    {
+      "code": "SFC1012",
+      "name": "SCHEMA_COMPILE_FAILED",
+      "category": "contract",
+      "stableSince": "1.0.0",
+      "meaning": "A registered schema does not compile under its declared dialect (the schema document itself is invalid)."
+    },
+    {
+      "code": "SFC1013",
+      "name": "CONSUMER_CONTRACT_VERSION_MISMATCH",
+      "category": "contract",
+      "stableSince": "1.14.0",
+      "meaning": "A consumer contract vector, capability identity, vector set, or Foundation package version does not match the installed Contracts package."
+    },
+    {
+      "code": "SFC2002",
+      "name": "UNKNOWN_OPERATION",
+      "category": "kernel",
+      "stableSince": "1.0.0",
+      "meaning": "The requested operation name is not in the frozen operation vocabulary of the referenced protocol version."
+    },
+    {
+      "code": "SFC2003",
+      "name": "INVALID_PARAMS",
+      "category": "kernel",
+      "stableSince": "1.0.0",
+      "meaning": "Operation params do not satisfy the frozen params contract of the requested operation."
+    },
+    {
+      "code": "SFC2004",
+      "name": "EXECUTION_FAILED",
+      "category": "kernel",
+      "stableSince": "1.0.0",
+      "meaning": "The mechanism runtime failed while executing a well-formed operation; details carry the mechanism evidence. Demonstrable only by a mechanism runtime, not by static contracts checks."
+    },
+    {
+      "code": "SFC3001",
+      "name": "REPORT_DIGEST_MISMATCH",
+      "category": "report",
+      "stableSince": "1.2.0",
+      "meaning": "A report binding digest (model, result, or report digest) does not match the recomputed sha256 digest, or the report is not the canonical render of its model; the binding is stale or tampered and is never trusted."
+    },
+    {
+      "code": "SFC3002",
+      "name": "REPORT_ELEMENT_MISSING",
+      "category": "report",
+      "stableSince": "1.2.0",
+      "meaning": "A mandatory report element is absent, empty where it must not be, or declared in an unsupported form: the conclusion, non-empty evidence, risks/next-action sections, a supported locale, or a coded outcome for failed/blocked runs. No half report is issued for a missing element."
+    },
+    {
+      "code": "SFC3003",
+      "name": "REPORT_FACT_DRIFT",
+      "category": "report",
+      "stableSince": "1.2.0",
+      "meaning": "A report model misstates the bound operation result's terminal state/errors, or rendered report bytes diverge from the deterministic re-render of the bound report model: fact fields rewritten, sections deleted, duplicated, or injected."
+    }
+  ]
+}

package/adapters/qoder/bin/foundation-legal/skill-family-contracts/LICENSE

@@ -0,0 +1,202 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright (c) 2026 skill-family-foundation-workspace contributors
+   Copyright (c) 2026 广州市风荷科技有限公司
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.