release-skill 0.9.17 → 0.9.18

package/adapters/cursor/src/schemas/profile-adoption-declaration.schema.json

@@ -0,0 +1,111 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://contracts.skill-family.example/v1/profile-adoption-declaration.json",
+  "title": "ProfileAdoptionDeclaration",
+  "description": "Profile adoption and override declaration (audit remediation D-6/D-8, SPI v3). Stand-alone contract form of the optional adoption and overrides sections of a provider descriptor and the required sections of a project profile: the adoption block carries the lightweight adoption proof (adopted Foundation profile identity plus the three-package Foundation pin with real-file sha256 digests), and the overrides block carries self-tightening rule declarations that reuse existing rule ids with project-level numeric values. The SPI layer forwards to these definitions and verifies tightening direction against the frozen rule baseline catalog.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "kind", "adoption"],
+  "properties": {
+    "schemaVersion": { "const": 1 },
+    "kind": { "const": "skill-family.profile-adoption-declaration" },
+    "adoption": { "$ref": "#/$defs/adoption" },
+    "overrides": { "$ref": "#/$defs/overrides" },
+    "note": {
+      "type": "string",
+      "description": "Optional human rationale; not consumed mechanically."
+    }
+  },
+  "$defs": {
+    "pinnedPackage": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["version", "path", "sha256"],
+      "properties": {
+        "version": {
+          "type": "string",
+          "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
+        },
+        "path": {
+          "type": "string",
+          "pattern": "^[A-Za-z0-9._-]+(/[A-Za-z0-9._-]+)*$"
+        },
+        "sha256": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{64}$"
+        }
+      }
+    },
+    "adoption": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["foundation_profile", "foundation_pin", "adopted_at"],
+      "properties": {
+        "foundation_profile": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["id", "version", "stability"],
+          "properties": {
+            "id": {
+              "type": "string",
+              "pattern": "^[a-z][a-z0-9]*(-[a-z0-9]+)*$"
+            },
+            "version": { "type": "integer", "minimum": 1 },
+            "stability": { "enum": ["stable", "candidate-only"] }
+          }
+        },
+        "capabilities": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "pattern": "^foundation\\.[a-z0-9\\-]+(?:\\.[a-z0-9\\-]+)+$"
+          }
+        },
+        "foundation_pin": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["algorithm", "packages"],
+          "properties": {
+            "algorithm": { "const": "sha256" },
+            "packages": {
+              "type": "object",
+              "additionalProperties": false,
+              "required": [
+                "skill-family-contracts",
+                "skill-family-harness-node",
+                "skill-family-engineering-kit"
+              ],
+              "properties": {
+                "skill-family-contracts": { "$ref": "#/$defs/pinnedPackage" },
+                "skill-family-harness-node": { "$ref": "#/$defs/pinnedPackage" },
+                "skill-family-engineering-kit": { "$ref": "#/$defs/pinnedPackage" }
+              }
+            }
+          }
+        },
+        "adopted_at": { "type": "string", "format": "date-time" }
+      }
+    },
+    "overrides": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["ruleId", "parameter", "value"],
+        "properties": {
+          "ruleId": {
+            "type": "string",
+            "pattern": "^SFA-[A-Z0-9]+-[0-9]{3}$"
+          },
+          "parameter": {
+            "type": "string",
+            "pattern": "^[a-zA-Z][a-zA-Z0-9]*$"
+          },
+          "value": { "type": "number" },
+          "note": { "type": "string" }
+        }
+      }
+    }
+  }
+}

package/adapters/cursor/src/schemas/profile-descriptor.schema.json

@@ -0,0 +1,99 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://contracts.skill-family.example/v1/profile-descriptor.json",
+  "title": "ProfileDescriptor",
+  "description": "Declares one profile: identity, the contracts base it extends, its finite declared differences from the base, and the stable SPI implementations it provides. The common core must not depend on concrete profiles.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "kind", "profile", "base"],
+  "properties": {
+    "schemaVersion": {
+      "const": 1
+    },
+    "kind": {
+      "const": "skill-family.profile-descriptor"
+    },
+    "profile": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "name", "version"],
+      "properties": {
+        "id": {
+          "type": "string",
+          "pattern": "^[a-z][a-z0-9]*(-[a-z0-9]+)*$",
+          "description": "Stable kebab-case profile identifier."
+        },
+        "name": {
+          "type": "string",
+          "minLength": 1
+        },
+        "version": {
+          "type": "string",
+          "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"
+        }
+      }
+    },
+    "base": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["contractsVersion"],
+      "properties": {
+        "contractsVersion": {
+          "type": "string",
+          "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$",
+          "description": "Contracts version this profile extends."
+        }
+      }
+    },
+    "differences": {
+      "type": "array",
+      "description": "Finite declared differences from the base contracts.",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["id", "kind", "target"],
+        "properties": {
+          "id": {
+            "type": "string",
+            "pattern": "^[a-z][a-z0-9]*(-[a-z0-9]+)*$"
+          },
+          "kind": {
+            "enum": ["adds", "overrides", "removes"]
+          },
+          "target": {
+            "type": "string",
+            "minLength": 1,
+            "description": "What the difference applies to (structure name, file role, or extension point)."
+          },
+          "note": {
+            "type": "string"
+          }
+        }
+      }
+    },
+    "spi": {
+      "type": "array",
+      "description": "Stable SPI implementations provided by this profile.",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["id", "version", "entrypoint"],
+        "properties": {
+          "id": {
+            "type": "string",
+            "pattern": "^[a-z][a-z0-9]*(-[a-z0-9]+)*$"
+          },
+          "version": {
+            "type": "integer",
+            "minimum": 1
+          },
+          "entrypoint": {
+            "type": "string",
+            "pattern": "^[A-Za-z0-9._-]+(/[A-Za-z0-9._-]+)*$",
+            "description": "Relative POSIX path of the SPI entrypoint module."
+          }
+        }
+      }
+    }
+  }
+}

package/adapters/cursor/src/schemas/project-manifest.schema.json

@@ -0,0 +1,67 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://contracts.skill-family.example/v1/project-manifest.json",
+  "title": "ProjectManifest",
+  "description": "Declares one Skill Family project adopting the contracts: stable identity, the contracts version and profile it uses, and the managed files owned by generators.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "kind", "project", "contracts"],
+  "properties": {
+    "schemaVersion": {
+      "const": 1
+    },
+    "kind": {
+      "const": "skill-family.project-manifest"
+    },
+    "project": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "name"],
+      "properties": {
+        "id": {
+          "type": "string",
+          "pattern": "^[a-z][a-z0-9]*(-[a-z0-9]+)*$",
+          "description": "Stable kebab-case project identifier."
+        },
+        "name": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Human-readable project name."
+        },
+        "description": {
+          "type": "string"
+        }
+      }
+    },
+    "contracts": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["version", "profile"],
+      "properties": {
+        "version": {
+          "type": "string",
+          "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$",
+          "description": "Contracts version the project adopts."
+        },
+        "profile": {
+          "type": "string",
+          "pattern": "^[a-z][a-z0-9]*(-[a-z0-9]+)*$",
+          "description": "Identifier of the profile the project uses."
+        }
+      }
+    },
+    "managedFiles": {
+      "type": "array",
+      "description": "Relative POSIX paths of managed files owned by generators. Path containment beyond shape (escape, traversal) is a mechanism concern owned by the harness.",
+      "items": {
+        "type": "string",
+        "pattern": "^[A-Za-z0-9._-]+(/[A-Za-z0-9._-]+)*$"
+      }
+    },
+    "updatedAt": {
+      "type": "string",
+      "format": "date-time",
+      "description": "RFC 3339 date-time of the last manifest update; format enforcement is part of the contracts dialect support."
+    }
+  }
+}

package/adapters/cursor/src/schemas/project-profile.schema.json

@@ -0,0 +1,25 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://contracts.skill-family.example/v1/project-profile.json",
+  "title": "ProjectProfile",
+  "description": "Declares a project's Skill Family adoption and tightening overrides.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "kind", "project", "adoption", "overrides"],
+  "properties": {
+    "schemaVersion": { "const": 1 },
+    "kind": { "const": "skill-family.project-profile" },
+    "project": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "workspace"],
+      "properties": {
+        "id": { "type": "string", "pattern": "^[a-z][a-z0-9]*(-[a-z0-9]+)*$" },
+        "workspace": { "type": "string", "minLength": 1 }
+      }
+    },
+    "adoption": { "$ref": "https://contracts.skill-family.example/v1/profile-adoption-declaration.json#/$defs/adoption" },
+    "overrides": { "$ref": "https://contracts.skill-family.example/v1/profile-adoption-declaration.json#/$defs/overrides" },
+    "note": { "type": "string" }
+  }
+}

package/adapters/cursor/src/schemas/public-boundary-declaration.schema.json

@@ -0,0 +1,73 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://contracts.skill-family.example/v1/public-boundary-declaration.json",
+  "title": "PublicBoundaryDeclaration",
+  "description": "Public release boundary declaration (audit SG-17). Declares the boundary between the public release file set and the internal working set of a project: the public roots under which public files may live, the files that are explicitly public, the paths that must be present in the release set, and the paths that must never enter it. Mechanical verification (required paths present, forbidden paths absent, no undeclared file under a public root) is performed by the engineering-kit public-boundary check against the actual file set; this contract freezes only the declaration shape.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion",
+    "kind",
+    "declarationId",
+    "declaredVersion",
+    "publicRoots",
+    "requiredPaths",
+    "forbiddenPaths",
+    "publicFiles"
+  ],
+  "properties": {
+    "schemaVersion": { "const": 1 },
+    "kind": { "const": "skill-family.public-boundary-declaration" },
+    "declarationId": {
+      "type": "string",
+      "pattern": "^[a-z][a-z0-9]*(-[a-z0-9]+)*$",
+      "description": "Stable kebab-case identifier of this boundary declaration."
+    },
+    "declaredVersion": {
+      "type": "string",
+      "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$",
+      "description": "Release version this boundary declaration applies to."
+    },
+    "publicRoots": {
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": {
+        "type": "string",
+        "pattern": "^[A-Za-z0-9._-]+(/[A-Za-z0-9._-]+)*$"
+      },
+      "description": "Project-root-relative POSIX directory roots; only files under these roots may belong to the public release set."
+    },
+    "requiredPaths": {
+      "type": "array",
+      "uniqueItems": true,
+      "items": {
+        "type": "string",
+        "pattern": "^[A-Za-z0-9._-]+(/[A-Za-z0-9._-]+)*$"
+      },
+      "description": "Paths that must exist in the release set; a missing required path is a boundary violation."
+    },
+    "forbiddenPaths": {
+      "type": "array",
+      "uniqueItems": true,
+      "items": {
+        "type": "string",
+        "pattern": "^[A-Za-z0-9._-]+(/[A-Za-z0-9._-]+)*$"
+      },
+      "description": "Paths that must never enter the public release set; presence of a forbidden path is a boundary violation."
+    },
+    "publicFiles": {
+      "type": "array",
+      "uniqueItems": true,
+      "items": {
+        "type": "string",
+        "pattern": "^[A-Za-z0-9._-]+(/[A-Za-z0-9._-]+)*$"
+      },
+      "description": "Explicit enumeration of the public files. Any file under a public root that is not listed here is an undeclared leak."
+    },
+    "note": {
+      "type": "string",
+      "description": "Optional human rationale; not consumed mechanically."
+    }
+  }
+}

package/adapters/cursor/src/schemas/report-binding.schema.json

@@ -0,0 +1,42 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://contracts.skill-family.example/v1/report-binding.json",
+  "title": "ReportBinding",
+  "description": "Binds one canonical rendered report to its report model and source machine result: the run identity, sha256 digests of the model, result, and report bytes, and the exact renderer version. Verification requires all three documents, re-renders the model, and recomputes every digest; any mismatch is SFC3001. A binding carries no prose and no facts of its own.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "kind", "runId", "modelDigest", "resultDigest", "reportDigest", "rendererVersion"],
+  "properties": {
+    "schemaVersion": {
+      "const": 1
+    },
+    "kind": {
+      "const": "skill-family.report-binding"
+    },
+    "runId": {
+      "type": "string",
+      "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$",
+      "description": "The run identity the bound report and machine result share; a mismatch with either side is never a valid binding."
+    },
+    "resultDigest": {
+      "type": "string",
+      "pattern": "^[0-9a-f]{64}$",
+      "description": "sha256 hex digest over the canonical JSON of the bound machine result document."
+    },
+    "modelDigest": {
+      "type": "string",
+      "pattern": "^[0-9a-f]{64}$",
+      "description": "sha256 hex digest over the canonical JSON of the bound report-model document."
+    },
+    "reportDigest": {
+      "type": "string",
+      "pattern": "^[0-9a-f]{64}$",
+      "description": "sha256 hex digest over the exact rendered report bytes."
+    },
+    "rendererVersion": {
+      "type": "string",
+      "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$",
+      "description": "Exact semver of the renderer that produced the bound report; no ranges."
+    }
+  }
+}