release-skill 0.9.16 → 0.9.18

package/src/core/foundation-host-verification.mjs

@@ -0,0 +1,168 @@
+/**
+ * Release-domain mapping for one frozen Cursor Skill. Foundation owns request
+ * preparation, installation, process supervision and bound stream reads.
+ */
+import { basename, join, isAbsolute } from 'node:path';
+import { mkdir } from 'node:fs/promises';
+import { prepareHostVerification, runHostVerification } from 'skill-family-engineering-kit';
+import { canonicalJson } from 'skill-family-contracts';
+import { createTemporaryWorkspace } from 'skill-family-harness-node';
+
+import { verifyFrozenSnapshot } from '../snapshot/frozen.mjs';
+import { canonicalPublicPath, publicPathCollisionKey } from '../snapshot/public-path.mjs';
+import { CONSUMER_VERIFICATION_DEFERRED, POST_PUBLISH_VERIFY_FAILED, ReleaseError } from './errors.mjs';
+
+function fail(message, details = {}) {
+  return new ReleaseError(POST_PUBLISH_VERIFY_FAILED, message, details);
+}
+
+/** Release-owned scenario policy, shared by freezing and consuming the contract. */
+export function assertCursorHostScenario(scenario) {
+  const keys = ['workloadDocument', 'fixtureFiles', 'protectedWorkspaceFiles', 'platformManifest', 'effectivePrompt', 'expectedResult'];
+  if (!scenario || typeof scenario !== 'object' || Array.isArray(scenario)
+    || Object.keys(scenario).length !== keys.length || keys.some((key) => !Object.hasOwn(scenario, key))) {
+    throw fail('Cursor host verification requires the complete frozen scenario');
+  }
+  for (const key of ['workloadDocument', 'effectivePrompt', 'expectedResult']) {
+    if (typeof scenario[key] !== 'string' || !scenario[key].isWellFormed()
+      || (key !== 'expectedResult' && scenario[key].length === 0)
+      || (key === 'effectivePrompt' && scenario[key].includes('\0'))) {
+      throw fail('Cursor scenario requires valid UTF-8 text', { field: key });
+    }
+  }
+  if (!scenario.platformManifest || typeof scenario.platformManifest !== 'object' || Array.isArray(scenario.platformManifest)) {
+    throw fail('Cursor scenario platformManifest must be a JSON object');
+  }
+  canonicalJson(scenario.platformManifest);
+  for (const field of ['fixtureFiles', 'protectedWorkspaceFiles']) {
+    const files = scenario[field];
+    if (!Array.isArray(files) || files.length === 0) throw fail('Cursor scenario files must be non-empty', { field });
+    const paths = [];
+    for (const file of files) {
+      if (!file || Object.keys(file).length !== 2 || typeof file.content !== 'string' || !file.content.isWellFormed()) {
+        throw fail('Cursor scenario file requires path and UTF-8 content', { field });
+      }
+      let path;
+      try { path = canonicalPublicPath(file.path).path; } catch { throw fail('Cursor scenario file path is unsafe', { field }); }
+      const key = publicPathCollisionKey(path);
+      if (path !== file.path || key.split('/').includes('.cursor')
+        || paths.some((other) => other === key || other.startsWith(key + '/') || key.startsWith(other + '/'))) {
+        throw fail('Cursor scenario files conflict or target a Cursor control path', { field });
+      }
+      paths.push(key);
+    }
+  }
+}
+
+/** Consume only frozen domain facts and this invocation's explicit private roots. */
+export async function verifyFrozenCursorSkillWithFoundation({
+  plan, unitId, root, cursorHostRuntime,
+  runHostVerificationFn = runHostVerification,
+  clock = () => new Date().toISOString(),
+} = {}) {
+  const unit = (plan?.units ?? []).find((candidate) => candidate.id === unitId);
+  const distribution = unit?.distributions?.find((candidate) => candidate.type === 'cursor-plugin');
+  const contract = distribution?.hostVerificationContract;
+  if (!unit?.frozenSnapshot?.path || !unit.frozenSnapshot.commit || !unit.frozenSnapshot.manifestDigest) {
+    throw fail('Cursor host verification requires a frozen unit snapshot', { unitId });
+  }
+  if (contract?.contractVersion !== 1 || contract.hostId !== 'cursor'
+    || contract.entrySkill !== distribution.entrySkill
+    || contract.payloadDigest !== unit.frozenSnapshot.manifestDigest
+    || contract.manifestRelativePath !== 'skills/' + contract.entrySkill + '/SKILL.md') {
+    throw fail('Cursor host verification contract does not bind the frozen payload and entry Skill', { unitId });
+  }
+  assertCursorHostScenario(contract.scenario);
+  if (!cursorHostRuntime || Object.keys(cursorHostRuntime).length !== 2
+    || !['executableRoot', 'existingUserStateRoot'].every((key) =>
+      typeof cursorHostRuntime[key] === 'string' && isAbsolute(cursorHostRuntime[key]))) {
+    throw fail('Cursor host verification requires explicit absolute executableRoot and existingUserStateRoot', { unitId });
+  }
+  const frozen = await verifyFrozenSnapshot({ root, snapshotPath: unit.frozenSnapshot.path, expectedDigest: contract.payloadDigest });
+  const prefix = 'skills/' + contract.entrySkill + '/';
+  const members = frozen.entries.filter((entry) => entry.type === 'file' && entry.path.startsWith(prefix))
+    .map((entry) => entry.path.slice(prefix.length));
+  if (!members.includes('SKILL.md')) throw fail('Cursor frozen entry Skill is missing SKILL.md', { unitId });
+  const scenario = contract.scenario;
+  const owned = await createTemporaryWorkspace({ prefix: 'release-skill-cursor-' });
+  let retain = false;
+  let prepared;
+  let result;
+  try {
+    const repositoryRoot = await owned.resolve('repository');
+    const workspaceRoot = join(repositoryRoot, 'workspace');
+    const sessionRoot = await owned.resolve('session');
+    await mkdir(workspaceRoot, { recursive: true, mode: 0o700 });
+    await mkdir(sessionRoot, { mode: 0o700 });
+    for (const file of scenario.protectedWorkspaceFiles) {
+      await owned.writeFile('repository/workspace/' + file.path, file.content, { mode: 0o600 });
+    }
+    prepared = await prepareHostVerification({
+      hostId: 'cursor',
+      verificationSetId: plan.digest + ':' + unitId + ':cursor',
+      candidate: {
+        ref: unit.frozenSnapshot.commit,
+        manifest: canonicalJson({
+          contractVersion: contract.contractVersion, unitId, candidateRef: unit.frozenSnapshot.commit,
+          payloadDigest: contract.payloadDigest, entrySkill: contract.entrySkill,
+          manifestRelativePath: contract.manifestRelativePath,
+        }),
+      },
+      skill: { root: join(frozen.snapshotDir, 'skills', contract.entrySkill), entrySkill: contract.entrySkill, members },
+      workloadDocument: scenario.workloadDocument,
+      fixtureFiles: scenario.fixtureFiles,
+      workspace: { repositoryRoot, root: workspaceRoot, protectedMembers: scenario.protectedWorkspaceFiles.map((file) => file.path) },
+      platformManifest: canonicalJson(scenario.platformManifest),
+      effectivePrompt: scenario.effectivePrompt,
+      executable: { root: cursorHostRuntime.executableRoot, relPath: 'cursor-agent' },
+      existingUserStateRoot: cursorHostRuntime.existingUserStateRoot,
+      sessionRoot,
+      timeoutPolicy: {
+        schemaVersion: 1, kind: 'skill-family.timeout-policy',
+        maxSeconds: (distribution.timeoutMs ?? 300000) / 1000, killGraceSeconds: 1,
+      },
+    });
+    // An unexpected exception after dispatch cannot establish process termination.
+    retain = true;
+    result = await runHostVerificationFn(prepared);
+    retain = !['observed', 'failed', 'rejected'].includes(result?.status);
+    if (retain) {
+      throw new ReleaseError(CONSUMER_VERIFICATION_DEFERRED,
+        'Cursor invocation is indeterminate; inspect the retained private scene before retrying with fresh runtime inputs', {
+          unitId,
+          requirements: [{ unitId, hostId: 'cursor', action: 'inspect-retained-cursor-scene', sceneId: basename(owned.root) }],
+        });
+    }
+    const stdout = result.streams ? await prepared.readInvocationStream(result, 'stdout') : null;
+    if (result.status !== 'observed') {
+      throw fail('Foundation Cursor invocation did not reach an observed result', { unitId, status: result.status, reason: result.reason });
+    }
+    if (!stdout) throw fail('Cursor invocation has no bound stdout evidence', { unitId });
+    let answer;
+    try { answer = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(stdout)); } catch {
+      throw fail('Cursor invocation did not return valid UTF-8 success JSON', { unitId });
+    }
+    if (answer?.type !== 'result' || answer.subtype !== 'success' || answer.is_error !== false
+      || typeof answer.result !== 'string' || answer.result !== scenario.expectedResult) {
+      throw fail('Cursor result does not match the frozen expected result', { unitId });
+    }
+    return {
+      planDigest: plan.digest, unitId, distributionType: 'cursor-plugin',
+      candidateRef: unit.frozenSnapshot.commit, payloadDigest: contract.payloadDigest,
+      manifestRelativePath: contract.manifestRelativePath, entrySkill: contract.entrySkill,
+      hostId: result.host.hostId, driverId: result.host.driverId, foundationStatus: result.status,
+      requestDigest: result.requestDigest, runtimeIdentities: result.runtimeIdentities,
+      execution: result.execution, snapshots: result.snapshots, streams: result.streams, observedAt: clock(),
+    };
+  } catch (error) {
+    if (error instanceof ReleaseError) throw error;
+    if (retain) {
+      throw new ReleaseError(CONSUMER_VERIFICATION_DEFERRED, 'Cursor invocation outcome is unknown; inspect the retained private scene', {
+        unitId, requirements: [{ unitId, hostId: 'cursor', action: 'inspect-retained-cursor-scene', sceneId: basename(owned.root) }],
+      });
+    }
+    throw fail('Foundation Cursor host verification failed closed', { unitId, foundationCode: error?.code ?? null });
+  } finally {
+    if (!retain) await owned.dispose();
+  }
+}

package/src/core/plan.mjs

@@ -413,7 +413,9 @@ function buildExpectedAdapterMap() {
     'create-tag': 'git-github',
     'github-release': 'github',
     'npm-publish': 'npm',
-    ...Object.fromEntries(PLATFORMS.map((p) => [p.actionType, p.adapter])),
+    ...Object.fromEntries(PLATFORMS
+      .filter((platform) => platform.actionType !== null)
+      .map((platform) => [platform.actionType, platform.adapter])),
     'set-default-branch': 'git-github',
   };
 }
@@ -857,6 +859,22 @@ export function validatePlanActionCompleteness(plan, options = {}) {
     for (const platform of PLATFORMS) {
       const dist = distributions.find((d) => d.type === platform.distributionType);
       if (!dist) continue;
+      if (platform.actionType === null) {
+        if (!dist.entrySkill) {
+          failures.push(`unit "${unitId}": ${platform.distributionType} distribution requires entrySkill`);
+        }
+        const contract = dist.hostVerificationContract;
+        if (
+          !contract
+          || contract.hostId !== platform.id
+          || contract.entrySkill !== dist.entrySkill
+          || contract.manifestRelativePath !== `skills/${dist.entrySkill}/SKILL.md`
+          || contract.payloadDigest !== frozen?.manifestDigest
+        ) {
+          failures.push(`unit "${unitId}": ${platform.distributionType} distribution host verification contract does not match the frozen payload`);
+        }
+        continue;
+      }
       const plugin = dist.plugin;
       const marketplace = dist.marketplace;
       const entrySkill = dist.entrySkill;

package/src/core/postpublish.mjs

@@ -30,6 +30,7 @@ import {
   resolvePresetRequiresApproval,
 } from './presets.mjs';
 import { checkGitRemoteUrl, describeGitRemoteUrlFailure } from './git-url-policy.mjs';
+import { classifyPathInput } from 'skill-family-harness-node';
 
 /** Secret-ish environment variable denylist (R3 credential hygiene). */
 export const ENV_ALLOWLIST_DENYLIST = /TOKEN|SECRET|PASSWORD|PASSPHRASE|API_KEY|CREDENTIAL/i;
@@ -42,7 +43,7 @@ const SAFE_ID_RE = /^[a-z0-9][a-z0-9._-]*$/;
 
 /** Branch pattern (leading alphanumeric blocks option-like names). */
 const BRANCH_RE = /^[A-Za-z0-9][A-Za-z0-9._/-]*$/;
-const LOCAL_HOSTS = new Set(['claude', 'codex', 'kimi', 'codebuddy', 'workbuddy']);
+const LOCAL_HOSTS = new Set(['claude', 'codex', 'kimi', 'codebuddy', 'workbuddy', 'qoder', 'cursor']);
 const HUB_HOST_RE = /^[A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?$/u;
 const HUB_REF_RE = /^refs\/heads\/[A-Za-z0-9][A-Za-z0-9._-]*(?:\/[A-Za-z0-9][A-Za-z0-9._-]*)*$/u;
 
@@ -500,6 +501,13 @@ export function validatePostPublishDeclaration(postPublish, options = {}) {
       if (hosts.has(host)) fail(`${unitLabel}localHostUpdate.hosts contains duplicate host "${host}"`);
       hosts.add(host);
     }
+    if (hosts.has('cursor')) {
+      if (!/^[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?$/u.test(localHostUpdate.plugin)) fail(`${unitLabel}Cursor plugin name must match the Cursor naming convention`);
+      const cursor = localHostUpdate.cursor;
+      if (!cursor || typeof cursor !== 'object' || Array.isArray(cursor)) fail(`${unitLabel}localHostUpdate.cursor is required`);
+      if (!classifyPathInput(cursor.sourcePath).ok) fail(`${unitLabel}localHostUpdate.cursor.sourcePath must be a safe relative path`);
+      if (cursor.dependencyInstall !== undefined && cursor.dependencyInstall !== 'npm-ci-ignore-scripts') fail(`${unitLabel}localHostUpdate.cursor.dependencyInstall is unsupported`);
+    } else if (localHostUpdate.cursor !== undefined) fail(`${unitLabel}localHostUpdate.cursor requires cursor in hosts`);
     const hub = localHostUpdate.hub;
     if (!hub || typeof hub !== 'object' || Array.isArray(hub)) {
       fail(`${unitLabel}localHostUpdate.hub must be a non-null object`);

package/src/core/run-retention.mjs

@@ -67,7 +67,7 @@ function postVerificationComplete(run) {
 function publicationComplete(run) {
   return run.checkpoints.every((cp) => COMPLETED_CHECKPOINTS.has(cp.status)
     || (['failed', 'deferred'].includes(cp.status)
-      && ['claude-marketplace-install', 'codex-marketplace-install', 'kimi-marketplace-install', 'codebuddy-marketplace-install'].includes(cp.actionType)));
+      && ['claude-marketplace-install', 'codex-marketplace-install', 'kimi-marketplace-install', 'codebuddy-marketplace-install', 'qoder-marketplace-install'].includes(cp.actionType)));
 }
 
 async function lineagePathsContained(run, runsRoot) {

package/src/core/run.mjs

@@ -464,7 +464,7 @@ async function validateStatePredecessorChain(run, runPath, options = {}) {
   }
 }
 
-function validateSourceRunEdge(child, parent) {
+export function validateSourceRunEdge(child, parent) {
   if (child.command === 'reconcile') {
     if (!['publish', 'reconcile'].includes(parent.command) || parent.status !== 'PARTIAL') {
       throw new ReleaseError(

package/src/core/surface-host-bindings.mjs

@@ -91,6 +91,7 @@ export function normalizeGenericSkillsRel(skillsRaw) {
 const SKILLS_NORMALIZERS = {
   claude: normalizeGenericSkillsRel,
   codex: normalizeGenericSkillsRel,
+  qoder: normalizeGenericSkillsRel,
   kimi: normalizeKimiSkillsRel,
   codebuddy: normalizeCodeBuddySkillsRel,
 };

package/src/core/verification-gates.mjs

@@ -57,7 +57,7 @@ function validateGate(gate) {
   if (!gate.scope || typeof gate.scope.unit !== 'string') {
     throw gateError(gate, 'must declare scope.unit');
   }
-  if (gate.phase === 'consumer-verify' && !['npm', 'claude-plugin', 'codex-plugin', 'kimi-plugin', 'codebuddy-plugin'].includes(gate.scope.distribution)) {
+  if (gate.phase === 'consumer-verify' && !['npm', 'claude-plugin', 'codex-plugin', 'kimi-plugin', 'codebuddy-plugin', 'qoder-plugin'].includes(gate.scope.distribution)) {
     throw gateError(gate, 'consumer-verify must declare a supported scope.distribution');
   }
   if (!Array.isArray(gate.command) || gate.command.length === 0 || gate.command.some((value) => typeof value !== 'string')) {

package/src/platforms/registry.mjs

@@ -132,6 +132,70 @@ function codexCrossValidateListEntry(found, action) {
   return { ok: true };
 }
 
+// --- qoder strategy -------------------------------------------------------
+
+function qoderParseListOutput(listOutput, pluginId) {
+  if (!Array.isArray(listOutput)) {
+    return { ok: false, error: 'Qoder plugin list did not return an array' };
+  }
+  const matches = listOutput.filter((entry) => entry?.id === pluginId);
+  if (matches.length === 0) {
+    return { ok: false, error: `plugin "${pluginId}" not found in Qoder plugin list` };
+  }
+  if (matches.length !== 1) {
+    return { ok: false, error: `plugin "${pluginId}" has duplicate Qoder list entries` };
+  }
+  const [found] = matches;
+  if (typeof found.installPath !== 'string' || found.installPath.length === 0) {
+    return { ok: false, error: `plugin "${pluginId}" found but missing installPath` };
+  }
+  return { ok: true, found, installPath: found.installPath };
+}
+
+function qoderParseMarketplaceListOutput(listOutput, marketplace) {
+  if (!Array.isArray(listOutput)) {
+    return { ok: false, error: 'Qoder marketplace list did not return an array' };
+  }
+  const matches = listOutput.filter((entry) => entry?.name === marketplace);
+  if (matches.length === 0) {
+    return { ok: false, error: `marketplace "${marketplace}" not found in Qoder marketplace list` };
+  }
+  if (matches.length !== 1) {
+    return { ok: false, error: `marketplace "${marketplace}" has duplicate Qoder list entries` };
+  }
+  const [found] = matches;
+  if (found.source?.source !== 'git' || typeof found.source.url !== 'string' || found.source.url.length === 0) {
+    return { ok: false, error: `marketplace "${marketplace}" has invalid Qoder git source` };
+  }
+  if (typeof found.installLocation !== 'string' || found.installLocation.length === 0) {
+    return { ok: false, error: `marketplace "${marketplace}" found but missing installLocation` };
+  }
+  return { ok: true, found, installPath: found.installLocation };
+}
+
+function qoderExtractInstallPath({ listParsed }) {
+  return { ok: true, installPath: listParsed?.installPath };
+}
+
+function qoderExtractListIdentity(found) {
+  return {
+    plugin: found.name,
+    marketplace: String(found.id ?? '').split('@').slice(1).join('@'),
+    version: found.version,
+  };
+}
+
+function qoderCrossValidateListEntry(found, action) {
+  const selector = `${action.plugin}@${action.marketplace}`;
+  if (found.name !== action.plugin || found.source !== selector || found.scope !== 'user') {
+    return { ok: false, error: `Qoder plugin "${selector}" does not match its frozen user-scope identity` };
+  }
+  if (found.version !== action.version) {
+    return { ok: false, error: `list version "${found.version}" does not match action version "${action.version}"` };
+  }
+  return { ok: true };
+}
+
 // --- platform descriptors --------------------------------------------------
 
 const CLAUDE = Object.freeze({
@@ -188,6 +252,7 @@ const CLAUDE = Object.freeze({
     pluginDirName: '.claude-plugin',
     templateFileName: 'plugin.json',
     hasMarketplace: false,
+    enabled: true,
   }),
   strategy: Object.freeze({
     parseListOutput: claudeParseListOutput,
@@ -249,6 +314,7 @@ const CODEX = Object.freeze({
     templateFileName: 'plugin.json',
     marketplaceFileName: null,
     hasMarketplace: false,
+    enabled: true,
   }),
   strategy: Object.freeze({
     parseListOutput: codexParseListOutput,
@@ -309,6 +375,7 @@ const KIMI = Object.freeze({
     templateFileName: 'plugin.json',
     marketplaceFileName: null,
     hasMarketplace: false,
+    enabled: true,
   }),
   strategy: Object.freeze({
     parseListOutput: null,
@@ -395,6 +462,7 @@ const CODEBUDDY = Object.freeze({
     templateFileName: 'plugin.json',
     marketplaceFileName: null,
     hasMarketplace: false,
+    enabled: true,
   }),
   strategy: Object.freeze({
     parseListOutput: null,
@@ -408,20 +476,126 @@ const CODEBUDDY = Object.freeze({
   }),
 });
 
-/** Ordered platform registry. Order is significant (claude, codex, kimi, codebuddy). */
-export const PLATFORMS = Object.freeze([CLAUDE, CODEX, KIMI, CODEBUDDY]);
+const QODER = Object.freeze({
+  id: 'qoder',
+  skillProjectionSurface: 'platforms/qoder',
+  distributionType: 'qoder-plugin',
+  actionType: 'qoder-marketplace-install',
+  adapter: 'plugin-marketplace',
+  automatable: true,
+  installMethod: 'structured-cli',
+  // Qoder's marketplace-add command follows the marketplace default branch;
+  // the frozen commit is checked from the materialized Hub checkout before
+  // installation, so marketplace add itself is not treated as a ref pin.
+  refStrength: 'commit-sha',
+  outputProtocol: 'structured',
+  identityEvidence: 'list-record',
+  degradationPolicy: 'block',
+  cli: Object.freeze({
+    binary: 'qodercli',
+    binaryAliases: Object.freeze(['qoder']),
+    marketplaceAdd: (repo) => ['plugins', 'marketplace', 'add', repo, '--scope', 'user'],
+    install: (plugin, marketplace) => ['plugins', 'install', `${plugin}@${marketplace}`, '--scope', 'user', '--json'],
+    marketplaceList: () => ['plugins', 'marketplace', 'list', '--json'],
+    list: () => ['plugins', 'list', '--json'],
+  }),
+  jsonProtocol: Object.freeze({
+    listOutput: 'array',
+    installPathSource: 'list',
+    marketplaceAddOutput: null,
+    pluginInstallOutput: null,
+  }),
+  isolationEnv: (home) => ({ HOME: home }),
+  isolationSubdirs: Object.freeze(['.qoder']),
+  manifestPaths: Object.freeze({
+    plugin: '.qoder-plugin/plugin.json',
+    marketplace: null,
+  }),
+  marketplaceSourceForm: null,
+  marketplaceEntryCarriesVersion: false,
+  marketplaceRefForm: null,
+  knownHostArtifacts: Object.freeze(['.git']),
+  schemaRequiredFields: Object.freeze(['plugin', 'marketplace', 'entrySkill']),
+  skillRendering: Object.freeze({ mode: 'substitute', preamble: 'qoder', placeholder: '${CLAUDE_PLUGIN_ROOT}' }),
+  buildAdapter: Object.freeze({
+    name: 'qoder',
+    pluginDirName: '.qoder-plugin',
+    templateFileName: 'plugin.json',
+    marketplaceFileName: null,
+    hasMarketplace: false,
+    enabled: true,
+  }),
+  strategy: Object.freeze({
+    parseListOutput: qoderParseListOutput,
+    parseMarketplaceListOutput: qoderParseMarketplaceListOutput,
+    extractInstallPath: qoderExtractInstallPath,
+    extractListIdentity: qoderExtractListIdentity,
+    crossValidateListEntry: qoderCrossValidateListEntry,
+    buildManualRequirement: null,
+    readManifest: null,
+  }),
+});
 
-const VALID_DISTRIBUTION_TYPES = new Set(['claude-plugin', 'codex-plugin', 'kimi-plugin', 'codebuddy-plugin']);
-const VALID_ACTION_TYPES = new Set(['claude-marketplace-install', 'codex-marketplace-install', 'kimi-marketplace-install', 'codebuddy-marketplace-install']);
+const CURSOR = Object.freeze({
+  id: 'cursor',
+  skillProjectionSurface: 'platforms/cursor',
+  distributionType: 'cursor-plugin',
+  actionType: null,
+  adapter: null,
+  automatable: true,
+  installMethod: 'foundation-host-verification',
+  refStrength: 'local-payload',
+  outputProtocol: 'structured',
+  identityEvidence: 'host-verification-result',
+  degradationPolicy: 'block',
+  cli: null,
+  jsonProtocol: Object.freeze({
+    listOutput: null,
+    installPathSource: null,
+    marketplaceAddOutput: null,
+    pluginInstallOutput: null,
+  }),
+  isolationEnv: null,
+  isolationSubdirs: Object.freeze([]),
+  manifestPaths: Object.freeze({ plugin: null, marketplace: null }),
+  marketplaceSourceForm: null,
+  marketplaceEntryCarriesVersion: null,
+  marketplaceRefForm: null,
+  knownHostArtifacts: Object.freeze([]),
+  schemaRequiredFields: Object.freeze(['entrySkill']),
+  skillRendering: null,
+  buildAdapter: Object.freeze({
+    name: 'cursor',
+    pluginDirName: '.cursor-plugin',
+    templateFileName: 'plugin.json',
+    marketplaceFileName: null,
+    hasMarketplace: false,
+    enabled: true,
+  }),
+  strategy: Object.freeze({
+    parseListOutput: null,
+    extractInstallPath: null,
+    extractListIdentity: null,
+    crossValidateListEntry: null,
+    buildManualRequirement: null,
+    readManifest: null,
+  }),
+});
+
+/** Ordered platform registry. Order is significant. */
+export const PLATFORMS = Object.freeze([CLAUDE, CODEX, KIMI, CODEBUDDY, QODER, CURSOR]);
+
+const VALID_DISTRIBUTION_TYPES = new Set(['claude-plugin', 'codex-plugin', 'kimi-plugin', 'codebuddy-plugin', 'qoder-plugin', 'cursor-plugin']);
+const VALID_ACTION_TYPES = new Set(['claude-marketplace-install', 'codex-marketplace-install', 'kimi-marketplace-install', 'codebuddy-marketplace-install', 'qoder-marketplace-install', null]);
 const VALID_SOURCE_FORMS = new Set(['string', 'local-path-object', null]);
 const VALID_MARKETPLACE_REF_FORMS = new Set(['sha', 'name', null]);
 const VALID_LIST_OUTPUTS = new Set(['array', 'installed-object', null]);
 const VALID_CLI_OUTPUTS = new Set(['json', null]);
 const VALID_ENTRY_VERSION_BINDING = new Set([true, false, null]);
-const VALID_INSTALL_METHODS = new Set(['structured-cli', 'interactive-only', 'human-attestation']);
-const VALID_REF_STRENGTHS = new Set(['commit-sha', 'name-ref', 'unfixable']);
+const VALID_INSTALL_METHODS = new Set(['structured-cli', 'interactive-only', 'human-attestation', 'foundation-host-verification']);
+const VALID_REF_STRENGTHS = new Set(['commit-sha', 'name-ref', 'unfixable', 'local-payload']);
 const VALID_OUTPUT_PROTOCOLS = new Set(['structured', 'text', 'none']);
-const VALID_IDENTITY_EVIDENCE = new Set(['list-record', 'install-output', 'filesystem-payload', 'human-attestation']);
+const VALID_IDENTITY_EVIDENCE = new Set(['list-record', 'install-output', 'filesystem-payload', 'human-attestation', 'host-verification-result']);
 const VALID_DEGRADATION_POLICIES = new Set(['block', 'human-attestation', 'human-attestation-with-fallback']);
 const SKILL_PROJECTION_SURFACE_PATTERN = /^platforms\/[a-z0-9]+(?:-[a-z0-9]+)*$/u;
 
@@ -442,19 +616,19 @@ const STANDALONE_SHA_RE = /^[0-9a-f]{40}$/u;
 function standaloneIdentityCore(platformOrId, fields) {
   const platform = typeof platformOrId === 'string' ? getPlatform(platformOrId) : platformOrId;
   const id = platform?.id;
-  if (id !== 'claude' && id !== 'codex') {
+  if (!['claude', 'codex', 'qoder'].includes(id)) {
     throw new Error(`standalone-index install identity is unsupported for platform "${id ?? '<unknown>'}"`);
   }
   const { name, source, version } = fields;
   if (typeof name !== 'string' || name.length === 0
     || !source || typeof source !== 'object' || Array.isArray(source)
     || typeof source.source !== 'string'
-    || typeof source.ref !== 'string' || source.ref.length === 0
     || typeof source.sha !== 'string' || !STANDALONE_SHA_RE.test(source.sha)) {
     throw new Error(`${id} standalone-index install identity has invalid owned fields`);
   }
   if (id === 'claude') {
-    if (source.source !== 'github' || typeof source.repo !== 'string' || source.repo.length === 0
+    if (typeof source.ref !== 'string' || source.ref.length === 0
+      || source.source !== 'github' || typeof source.repo !== 'string' || source.repo.length === 0
       || typeof version !== 'string' || version.length === 0) {
       throw new Error('Claude standalone-index install identity requires github repo, ref, sha, and version');
     }
@@ -465,6 +639,12 @@ function standaloneIdentityCore(platformOrId, fields) {
     };
   }
   if (source.source !== 'url' || typeof source.url !== 'string' || source.url.length === 0) {
+    throw new Error(`${id === 'qoder' ? 'Qoder' : 'Codex'} standalone-index install identity requires url and sha`);
+  }
+  if (id === 'qoder') {
+    return { name, source: { source: 'url', url: source.url, sha: source.sha } };
+  }
+  if (typeof source.ref !== 'string' || source.ref.length === 0) {
     throw new Error('Codex standalone-index install identity requires url, ref, and sha');
   }
   return {
@@ -494,6 +674,12 @@ export function buildExpectedStandaloneIndexInstallIdentity(platformOrId, frozen
       source: { source: 'url', url: `https://github.com/${repo}.git`, ref: `refs/tags/${tag}`, sha },
     });
   }
+  if (id === 'qoder') {
+    return standaloneIdentityCore(platform, {
+      name,
+      source: { source: 'url', url: `https://github.com/${repo}.git`, sha },
+    });
+  }
   return standaloneIdentityCore(platform, { name, source: {}, version });
 }
 
@@ -531,6 +717,12 @@ export function projectObservedStandaloneIndexInstallIdentity(platformOrId, entr
       },
     });
   }
+  if (id === 'qoder') {
+    return standaloneIdentityCore(platform, {
+      name: entry.name,
+      source: { source: source.source, url: source.url, sha: source.sha },
+    });
+  }
   return standaloneIdentityCore(platform, { name: entry.name, source });
 }
 
@@ -573,16 +765,22 @@ export function assertRegistry(registry = PLATFORMS) {
     if (!VALID_ACTION_TYPES.has(platform.actionType)) {
       throw new Error(`platform registry: ${label} has illegal actionType "${platform.actionType}"`);
     }
-    if (typeof platform.adapter !== 'string' || platform.adapter.length === 0) {
+    if (platform.installMethod !== 'foundation-host-verification'
+        && (typeof platform.adapter !== 'string' || platform.adapter.length === 0)) {
       throw new Error(`platform registry: ${label} needs a non-empty adapter id`);
     }
+    if (platform.installMethod === 'foundation-host-verification'
+        && (platform.actionType !== null || platform.adapter !== null)) {
+      throw new Error(`platform registry: ${label} host verification must not declare a checkpoint action or adapter`);
+    }
     if (!VALID_ENTRY_VERSION_BINDING.has(platform.marketplaceEntryCarriesVersion)) {
       throw new Error(`platform registry: ${label} has illegal marketplaceEntryCarriesVersion "${platform.marketplaceEntryCarriesVersion}"`);
     }
     if (typeof platform.automatable !== 'boolean') {
       throw new Error(`platform registry: ${label} automatable must be boolean`);
     }
-    if (typeof platform.isolationEnv !== 'function') {
+    if (platform.installMethod !== 'foundation-host-verification'
+        && typeof platform.isolationEnv !== 'function') {
       throw new Error(`platform registry: ${label} isolationEnv must be a function`);
     }
     if (!VALID_SOURCE_FORMS.has(platform.marketplaceSourceForm)) {
@@ -603,6 +801,9 @@ export function assertRegistry(registry = PLATFORMS) {
     if (!platform.buildAdapter || typeof platform.buildAdapter !== 'object') {
       throw new Error(`platform registry: ${label} buildAdapter must be an object`);
     }
+    if (typeof platform.buildAdapter.enabled !== 'boolean') {
+      throw new Error(`platform registry: ${label} buildAdapter.enabled must be boolean`);
+    }
     // D6: the adapter directory name is always explicit — prepare's G4
     // declared-host reconciliation and the build producer both key on it.
     if (typeof platform.buildAdapter.name !== 'string' || platform.buildAdapter.name.length === 0) {
@@ -649,7 +850,11 @@ export function assertRegistry(registry = PLATFORMS) {
       throw new Error(`platform registry: ${label} has illegal degradationPolicy "${platform.degradationPolicy}"`);
     }
 
-    if (platform.automatable) {
+    if (platform.installMethod === 'foundation-host-verification') {
+      if (platform.cli !== null) {
+        throw new Error(`platform registry: ${label} Foundation host verification must have cli === null`);
+      }
+    } else if (platform.automatable) {
       if (!platform.cli || typeof platform.cli.marketplaceAdd !== 'function'
           || typeof platform.cli.install !== 'function' || typeof platform.cli.list !== 'function') {
         throw new Error(`platform registry: automatable platform ${label} needs cli template functions`);
@@ -690,7 +895,8 @@ export function assertRegistry(registry = PLATFORMS) {
 
     // --- capability contract consistency rules (能力契约一致性规则) -----------
     // automatable === true 必须有 installMethod === 'structured-cli'
-    if (platform.automatable === true && platform.installMethod !== 'structured-cli') {
+    if (platform.automatable === true
+        && !['structured-cli', 'foundation-host-verification'].includes(platform.installMethod)) {
       throw new Error(`platform registry: ${label} is automatable but installMethod is "${platform.installMethod}" (expected "structured-cli")`);
     }
     // automatable === false 必须有 installMethod !== 'structured-cli'
@@ -728,6 +934,9 @@ export function resolvePlatformRoute(platform) {
   if (installMethod === 'interactive-only' || installMethod === 'human-attestation') {
     return { route: 'human-attestation', reason: `installMethod is ${installMethod}` };
   }
+  if (installMethod === 'foundation-host-verification') {
+    return { route: 'host-verification', reason: 'installMethod is foundation-host-verification' };
+  }
   throw new Error(
     `platform "${platform?.id ?? '<unknown>'}" with installMethod="${installMethod}" cannot be routed`,
   );
@@ -745,7 +954,7 @@ export function resolveCapabilityConflicts(platform) {
   const { id, automatable, installMethod, refStrength, identityEvidence, cli, strategy } = platform;
 
   // automatable <-> installMethod 一致性
-  if (automatable === true && installMethod !== 'structured-cli') {
+  if (automatable === true && !['structured-cli', 'foundation-host-verification'].includes(installMethod)) {
     conflicts.push(`automatable=true but installMethod="${installMethod}"`);
   }
   if (automatable === false && installMethod === 'structured-cli') {
@@ -763,7 +972,7 @@ export function resolveCapabilityConflicts(platform) {
   }
 
   // 自动化平台必须有 cli 和策略解析函数
-  if (automatable === true) {
+  if (automatable === true && installMethod !== 'foundation-host-verification') {
     if (!cli || typeof cli !== 'object') {
       conflicts.push(`automatable=true but cli is missing`);
     }