skill-family-engineering-kit 0.11.0 → 0.13.0

package/CHANGELOG.md

@@ -1,5 +1,46 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.13.0 locale=en baseline=sha256:b9eed0b2361ff46c23ddd903b98b7059d9ceed8329f846010cb4a943101ec9a3 -->
+## [0.13.0] - 2026-08-26
+
+Engineering Kit 0.13.0 is a source candidate for complete plugin verification with separate installation, discovery and invocation facts.
+
+### Added
+
+- Adds the permanent candidate root entry runPluginVerification({ request, bindings, hostsRoot }).
+- Preserves complete plugin layouts and exposes installation observations without taking over caller acceptance policy.
+
+### Upgrade Notes
+
+Pin the three packages together. Existing runHostVerification and verifyHostVerificationBindings remain available for single-Skill verification. Every actual host/source combination still needs qualification; no publication or consumer mechanism removal is implied.
+<!-- release-skill:changelog:end version=0.13.0 locale=en -->
+
+
+<!-- release-skill:changelog:start version=0.12.0 locale=en baseline=sha256:6000579dc8b473dbeda1832274d971df0c4f3a62a90c973184dd70e59ffc8602 -->
+## [0.12.0] - 2026-08-26
+
+Engineering Kit 0.12.0 extends bounded real-host verification from two to five fixed built-in drivers.
+
+### Added
+
+- Extends runHostVerification with three fixed built-in drivers while retaining the Kimi and WorkBuddy raw-byte behavior.
+
+### Changed
+
+- Uses the classic plugin-root/skills/skill-id layout for the plugin-directory driver and validates complete JSONL event streams before accepting execution.
+- Keeps output meaning with consumers and applies strict text decoding only to the three new text-protocol drivers.
+- Registers Qoder as manual for host support and descriptor maturity, while its real-host verification capability remains candidate.
+
+### Fixed
+
+- Rejects malformed protocol tails, invalid UTF-8 in text-protocol drivers, and version suffixes outside each driver's fixed format before they can support a successful public result.
+
+### Upgrade Notes
+
+Pin all three Foundation packages to 0.12.0. Existing runHostVerification and verifyHostVerificationBindings entrypoints and request identities remain unchanged. Reuse the host's existing login state; Foundation does not isolate authentication, freeze model identity, disable host tools, or decide domain PASS/FAIL. Qoder verification grants no build, plan, apply, install, update, uninstall, or rollback capability. The executable digest is a preflight observation and member snapshots cover only the declared members at the two observed times.
+<!-- release-skill:changelog:end version=0.12.0 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.11.0 locale=en baseline=sha256:108e261312b0838af53184710453fe19f369a9ea10ac5d1fc3e829e919d0f99d -->
 ## [0.11.0] - 2026-08-25
 

package/CHANGELOG.zh-CN.md

@@ -1,5 +1,46 @@
 # 变更日志
 
+<!-- release-skill:changelog:start version=0.13.0 locale=zh-CN baseline=sha256:3493c49151b2ebabddcba806d892ce967c0ae47621b0b2c75086e1cac334ebf9 -->
+## [0.13.0] - 2026-08-26
+
+Engineering Kit 0.13.0 源码候选增加完整插件验证，分别报告安装、发现和调用事实。
+
+### 新增
+
+- 新增永久候选根入口 runPluginVerification({ request, bindings, hostsRoot })。
+- 保留完整插件布局并提供安装观察，载荷接受政策仍由调用方决定。
+
+### 升级说明
+
+三个包须精确锁步。runHostVerification 与 verifyHostVerificationBindings 继续用于单 Skill 验证。每个真实宿主与来源组合仍须取得资格证据；本次不代表发布完成或消费者机制已退出。
+<!-- release-skill:changelog:end version=0.13.0 locale=zh-CN -->
+
+
+<!-- release-skill:changelog:start version=0.12.0 locale=zh-CN baseline=sha256:f2a68cdeac0b2a44d7a4cc64df8e8f371795b4150719d821a31866a6e8873e2f -->
+## [0.12.0] - 2026-08-26
+
+Engineering Kit 0.12.0 将受约束真实宿主验证从两个固定内置驱动扩展为五个。
+
+### 新增
+
+- 为 runHostVerification 增加三个固定的内置驱动，保留 Kimi 与 WorkBuddy 的原始字节行为。
+
+### 变更
+
+- 插件目录驱动使用 plugin-root/skills/skill-id 经典插件布局；JSONL 驱动必须扫描完整事件流后才接受执行结果。
+- 输出的业务含义由消费者判断，严格文本解码仅用于三个新增的文本协议驱动。
+- Qoder 的宿主支持和 Descriptor 成熟度登记为 manual，真实宿主验证能力继续标为 candidate。
+
+### 修复
+
+- 拒绝畸形协议尾部、文本协议中的非法 UTF-8，以及驱动固定格式之外的版本后缀，避免产生错误的公共成功结果。
+
+### 升级说明
+
+三个 Foundation 包须精确锁定到同一 0.12.0 版本。runHostVerification、verifyHostVerificationBindings 入口与请求身份不变。验证复用宿主现有登录态；Foundation 不隔离认证、不固定模型身份、不关闭宿主工具，也不判定领域 PASS/FAIL。Qoder 验证不授予 build、plan、apply、install、update、uninstall 或 rollback 能力。可执行文件摘要仅是启动前观察，成员快照仅覆盖已声明成员的两个观察时点。
+<!-- release-skill:changelog:end version=0.12.0 locale=zh-CN -->
+
+
 <!-- release-skill:changelog:start version=0.11.0 locale=zh-CN baseline=sha256:5d5852f3fa3c970b4d277600a0886d533e3c883fc72ce144a85a071d1e270771 -->
 ## [0.11.0] - 2026-08-25
 

package/README.md

@@ -4,28 +4,23 @@
 
 # skill-family-engineering-kit
 
-<!-- release-skill:release-version: 0.11.0 -->
+<!-- release-skill:release-version: 0.13.0 -->
 
 An engineering toolkit used in development and CI. There are **exactly four** top-level commands, and no fifth:
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.11.0** (2026-08-25)
+**0.13.0** (2026-08-26)
 
-Engineering Kit 0.11.0 adds a candidate real-host verification API and ships the registered host Profile closure.
+Engineering Kit 0.13.0 is a source candidate for complete plugin verification with separate installation, discovery and invocation facts.
 
 **Added**
 
-- Adds runHostVerification for one fresh, bounded Kimi or WorkBuddy invocation reusing the caller's existing login state, and verifyHostVerificationBindings for pure result composition.
-- Recomputes closure and stream digests from raw bytes and keeps private evidence outside the public result.
-- Ships the registered host Profile closure through bundledHostProfilesRoot().
-
-**Changed**
-
-- Manual Profiles retain their lifecycle restrictions; host verification does not grant build, plan, apply, install, update, uninstall, or rollback support.
+- Adds the permanent candidate root entry runPluginVerification({ request, bindings, hostsRoot }).
+- Preserves complete plugin layouts and exposes installation observations without taking over caller acceptance policy.
 
 **Upgrade Notes**
 
-The 0.11.0 host-verification API is candidate-only. It does not own domain PASS/FAIL, release state, or automatic login, and it claims no authentication isolation, unchanged credentials, fixed model identity, or disabled host tool capability. executableSha256 is a point-in-time preflight observation, not proof of the executed image; the caller exclusively controls that namespace. Foundation retains session directories, and the caller cleans its outer temporaryRoot after inspection.
+Pin the three packages together. Existing runHostVerification and verifyHostVerificationBindings remain available for single-Skill verification. Every actual host/source combination still needs qualification; no publication or consumer mechanism removal is implied.
 <!-- release-skill:managed:end id=latest-release -->
 
 | Command | Purpose | Side effects |
@@ -45,8 +40,10 @@ Kit is the "engineering stage" layer, depending on the Harness and Contracts. It
 
 ## Installation and Minimal Example
 
+Version 0.13.0 is not published. The registry command below is for use after publication; this iteration installs the three local candidate tarballs in an isolated directory.
+
 ```sh
-npm install --save-dev skill-family-engineering-kit@0.11.0
+npm install --save-dev skill-family-engineering-kit@0.13.0
 npm exec -- skill-family-kit --help
 npm exec -- skill-family-kit scaffold --root <empty-dir> --project-id my-project
 npm exec -- skill-family-kit adopt-plan --root <repo>
@@ -54,7 +51,7 @@ npm exec -- skill-family-kit projection --root <repo>
 npm exec -- skill-family-kit check --root <repo>
 ```
 
-The four commands above cover skeleton generation, read-only inventory, managed projection, and diagnostics respectively; a zero-install form is available via `npm exec --package=skill-family-engineering-kit@0.11.0 -- skill-family-kit --help`.
+The four commands above cover skeleton generation, read-only inventory, managed projection, and diagnostics respectively; a zero-install form is available via `npm exec --package=skill-family-engineering-kit@0.13.0 -- skill-family-kit --help`.
 
 ### Public Profile SPI
 
@@ -108,13 +105,13 @@ npm exec -- skill-family-kit scaffold host-build --root <workspace> --host <id>
 npm exec -- skill-family-kit adopt-plan host-plan --root <workspace> --host <id> --path-category <id> --build-manifest <relpath> --probe-facts <relpath> --hosts-root <dir>
 ```
 
-The Profile must be provided explicitly; Kit does not bind a specific host by default. Canonical host IDs may resolve only aliases declared by the finite registered Profile set. Probe starts no process by default; only when both `--allow-host-spawn --host-executable <absolute-path>` are given is the frozen version vector executed. Local install and update use an explicit authorization reference plus the existing contained publication primitives; uninstall is rejected with `manual-recovery-required` because Foundation has no safe bound deletion primitive. Two registered hosts have trusted version drivers; Kimi Code, WorkBuddy, CodeBuddy, and DeepSeek Harness expose independent manual facts; Qoder is `unsupported`. Adapter source only accepts declared text closures; binary projection is not supported; see the [host capability matrix](../../docs/reference/host-capability-matrix.md) and registered Profiles.
+The Profile must be provided explicitly; Kit does not bind a specific host by default. Canonical host IDs may resolve only aliases declared by the finite registered Profile set. Probe starts no process by default; only when both `--allow-host-spawn --host-executable <absolute-path>` are given is the frozen version vector executed. Local install and update use an explicit authorization reference plus the existing contained publication primitives; uninstall is rejected with `manual-recovery-required` because Foundation has no safe bound deletion primitive. Two registered hosts have trusted version drivers; Kimi Code, WorkBuddy, CodeBuddy, and DeepSeek Harness expose independent manual facts. Qoder is `manual` from 0.12.0; its candidate real-host verification grants no lifecycle support. Adapter source only accepts declared text closures; binary projection is not supported; see the [host capability matrix](../../docs/reference/host-capability-matrix.md) and registered Profiles.
 
 ### Candidate real-host verification library API
 
-`runHostVerification({ request, bindings, hostsRoot })` and `verifyHostVerificationBindings({ results, expectedCommon, expectedRequestDigestByHost })` are library APIs, not a fifth Kit command. The first runs one bounded candidate verification against caller-bound roots using an admitted built-in driver (`kimi-code-print-v1` or `workbuddy-codebuddy-print-v1`, both bound to `existing-user-state + host-managed`) and returns a Contracts-validated, redacted four-state result. The second is pure and combines only `observed` results with the exact common fields and per-host request digest expected by the caller.
+`runHostVerification({ request, bindings, hostsRoot })` and `verifyHostVerificationBindings({ results, expectedCommon, expectedRequestDigestByHost })` are library APIs, not a fifth Kit command. The first runs one bounded candidate verification against caller-bound roots using a fixed built-in driver and returns a Contracts-validated, redacted four-state result. All five drivers use `existing-user-state + host-managed`; their exact identities and limitations are listed in the [host capability matrix](../../docs/reference/host-capability-matrix.md). The second API is pure and combines only `observed` results with the exact common fields and per-host request digest expected by the caller.
 
-The API keeps consumer workload, domain output checks, domain PASS/FAIL, release freshness, and release state outside Foundation. The caller supplies a canonical `existingUserStateRoot` that is projected into the child environment but never read, digested, modified or cleaned by Foundation; it does not grant manual Profiles any build, plan, apply, install, update, or uninstall capability. The Kimi and WorkBuddy real-host publication gates remain a hard publication requirement for 0.11.0.
+The API keeps consumer workload, domain output checks, domain PASS/FAIL, release freshness, and release state outside Foundation. The caller supplies a canonical `existingUserStateRoot` that is projected into the child environment but never read, digested, modified or cleaned by Foundation; it does not grant manual Profiles any build, plan, apply, install, update, or uninstall capability. Version 0.12.0 requires real-host verification of all five fixed drivers before publication; the API does not own that release decision.
 
 `executableSha256` binds only the bytes observed by the strict preflight read; the actual process is still spawned by pathname, so the caller must exclusively control the executable namespace through probe and invocation. Foundation retains the call's `session-*` directory and never deletes it by pathname. After inspection, the caller cleans its exclusively owned outer `temporaryRoot`.
 
@@ -234,3 +231,9 @@ This package must not perform git init, commit, push, tag, stash, branch switch,
 - Package-local source: `src/*.mjs`.
 - Package-local candidate source: `candidate/*`; canonical public imports: `skill-family-engineering-kit/quickstart-profile`, `/adoption`, and `/skill-naming`; historical migration alias: `skill-family-engineering-kit/candidate/quickstart-profile`.
 <!-- agent-quick-reference:end -->
+
+## Complete Plugin Candidate
+
+The candidate runPluginVerification({ request, bindings, hostsRoot }) preserves a complete plugin layout and separates installation, discovery and invocation facts. Each actual host/source combination still needs qualification evidence.
+
+Version 0.13.0 is a local source candidate and is not published. Consume the three locally verified tarballs; a version marker, unit test or successful install is not complete host qualification or release approval.

package/README.zh-CN.md

@@ -5,28 +5,23 @@
 
 # skill-family-engineering-kit
 
-<!-- release-skill:release-version: 0.11.0 -->
+<!-- release-skill:release-version: 0.13.0 -->
 
 开发与 CI 阶段使用的工程工具包。**恰好四个**顶层命令，没有第五个：
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.11.0** (2026-08-25)
+**0.13.0** (2026-08-26)
 
-Engineering Kit 0.11.0 增加候选真实宿主验证 API，并随包携带已登记宿主 Profile 闭包。
+Engineering Kit 0.13.0 源码候选增加完整插件验证，分别报告安装、发现和调用事实。
 
 **新增**
 
-- 新增 runHostVerification，执行一次 fresh、受约束的 Kimi 或 WorkBuddy 调用（复用调用方现有登录态）；新增 verifyHostVerificationBindings，组合结果时只做纯校验。
-- 从原始字节重算闭包和流摘要，并把私有证据留在公共结果之外。
-- 通过 bundledHostProfilesRoot() 携带已登记宿主 Profile 闭包。
-
-**变更**
-
-- manual Profile 继续保留生命周期限制；宿主验证不会授予 build、plan、apply、install、update、uninstall 或 rollback 能力。
+- 新增永久候选根入口 runPluginVerification({ request, bindings, hostsRoot })。
+- 保留完整插件布局并提供安装观察，载荷接受政策仍由调用方决定。
 
 **升级说明**
 
-0.11.0 宿主验证 API 仍为候选能力，不拥有领域 PASS/FAIL、发布状态或自动登录；不宣称认证状态隔离、凭证未变化、模型身份固定或宿主工具能力已关闭。executableSha256 只是启动前的点时观察，不证明实际执行映像；调用方独占对应命名空间。Foundation 保留 session 目录，调用方检查后清理外层 temporaryRoot。
+三个包须精确锁步。runHostVerification 与 verifyHostVerificationBindings 继续用于单 Skill 验证。每个真实宿主与来源组合仍须取得资格证据；本次不代表发布完成或消费者机制已退出。
 <!-- release-skill:managed:end id=latest-release -->
 
 | 命令 | 用途 | 副作用 |
@@ -46,8 +41,10 @@ Kit 是「工程阶段」层，依赖 Harness 与 Contracts。它只做四件事
 
 ## 安装和最小示例
 
+0.13.0 尚未发布。下面的 registry 安装命令供发布后使用；本轮验证应在隔离目录安装三个本地候选 tarball。
+
 ```sh
-npm install --save-dev skill-family-engineering-kit@0.11.0
+npm install --save-dev skill-family-engineering-kit@0.13.0
 npm exec -- skill-family-kit --help
 npm exec -- skill-family-kit scaffold --root <empty-dir> --project-id my-project
 npm exec -- skill-family-kit adopt-plan --root <repo>
@@ -55,7 +52,7 @@ npm exec -- skill-family-kit projection --root <repo>
 npm exec -- skill-family-kit check --root <repo>
 ```
 
-以上四条命令分别覆盖生成骨架、只读盘点、受管投影与诊断；零安装形式可用 `npm exec --package=skill-family-engineering-kit@0.11.0 -- skill-family-kit --help`。
+以上四条命令分别覆盖生成骨架、只读盘点、受管投影与诊断；零安装形式可用 `npm exec --package=skill-family-engineering-kit@0.13.0 -- skill-family-kit --help`。
 
 ### 公共 Profile SPI
 
@@ -109,7 +106,15 @@ npm exec -- skill-family-kit scaffold host-build --root <workspace> --host <id>
 npm exec -- skill-family-kit adopt-plan host-plan --root <workspace> --host <id> --path-category <id> --build-manifest <relpath> --probe-facts <relpath> --hosts-root <dir>
 ```
 
-Profile 必须显式提供，Kit 不默认绑定具体宿主。规范宿主 ID 只能解析已登记有限 Profile 中声明的 alias。probe 默认不启动进程；只有同时给出 `--allow-host-spawn --host-executable <绝对路径>` 才执行冻结版本向量。本地 install/update 通过显式授权引用和既有受收容发布原语执行；uninstall 因没有安全的绑定删除原语而返回 `manual-recovery-required`，不删除文件。Claude/Codex 使用受信版本 driver；Kimi Code、WorkBuddy、CodeBuddy 和 DeepSeek Harness 只提供独立手动事实；Qoder 为 `unsupported`。adapter source 只接受已声明的文本闭包，不支持二进制投影；精确宿主支持矩阵见 [宿主能力矩阵](../../docs/reference/host-capability-matrix.md) 与已登记 Profile。
+Profile 必须显式提供，Kit 不默认绑定具体宿主。规范宿主 ID 只能解析已登记有限 Profile 中声明的 alias。probe 默认不启动进程；只有同时给出 `--allow-host-spawn --host-executable <绝对路径>` 才执行冻结版本向量。本地 install/update 通过显式授权引用和既有受收容发布原语执行；uninstall 因没有安全的绑定删除原语而返回 `manual-recovery-required`，不删除文件。Claude/Codex 使用受信版本 driver；Kimi Code、WorkBuddy、CodeBuddy 和 DeepSeek Harness 只提供独立手动事实。Qoder 自 0.12.0 起为 `manual`，候选真实验证不授予生命周期能力。adapter source 只接受已声明的文本闭包，不支持二进制投影；精确宿主支持矩阵见 [宿主能力矩阵](../../docs/reference/host-capability-matrix.md) 与已登记 Profile。
+
+### 候选真实宿主验证 API
+
+`runHostVerification({ request, bindings, hostsRoot })` 使用固定内置驱动执行一次受约束验证，返回经过 Contracts 校验和脱敏的四态结果。五个驱动覆盖 Kimi、WorkBuddy、Claude Code、Codex exec 和 Qoder CLI，均复用 `existing-user-state + host-managed` 登录态。`verifyHostVerificationBindings({ results, expectedCommon, expectedRequestDigestByHost })` 只组合校验 `observed` 结果，公共字段与请求摘要必须匹配调用方预期。两者都是库 API，不增加第五个 Kit 命令。
+
+调用方保留工作负载、领域输出检查、领域 PASS/FAIL、发布新鲜度和发布状态。规范路径 `existingUserStateRoot` 仅投影到子进程环境，Foundation 自身不读取、摘要、修改或清理其中内容，也不授予手动宿主生命周期能力。0.12.0 发布前须完成五个固定驱动的真实验证，发布决定不归该 API。
+
+`executableSha256` 只绑定启动前严格读取的字节，进程仍按路径启动；调用方须在版本观察和执行期间独占可执行文件命名空间。Foundation 保留 `session-*` 目录，调用方检查后清理独占的外层 `temporaryRoot`。
 
 ### 候选真实宿主验证库 API
 
@@ -235,3 +240,9 @@ projection 只写同时满足两个条件的路径：manifest 列出，且目标
 - 包内源：`src/*.mjs`。
 - 包内 Candidate 源：`candidate/*`；规范公共导入：`skill-family-engineering-kit/quickstart-profile`、`/adoption` 与 `/skill-naming`；历史迁移别名：`skill-family-engineering-kit/candidate/quickstart-profile`。
 <!-- agent-quick-reference:end -->
+
+## 完整插件候选能力
+
+新增候选 runPluginVerification({ request, bindings, hostsRoot })，保留完整插件布局并分别报告安装、发现与调用事实。真实宿主与来源组合仍需独立资格证据。
+
+0.13.0 为本地源码候选，尚未发布。消费本地已验证的三包 tarball，不能把版本标记、单元测试或安装成功当作完整宿主资格与发布批准。

package/SECURITY.md

@@ -4,10 +4,10 @@
 
 | 版本 | 安全支持状态 |
 | --- | --- |
-| 0.1.x | 当前维护线：接受安全报告 |
+| 0.13.x | 当前维护线：接受安全报告 |
 | 0.0.0 | 未发布的内部骨架版本，不在公开支持范围 |
 
-安全修复只承诺在最新的 0.1.x 线上提供；更早版本不回移修复。
+安全修复只承诺在最新的 0.13.x 线上提供；更早版本不回移修复。
 
 ## 报告漏洞
 

package/data/hosts/claude/host-descriptor.json

@@ -10,6 +10,11 @@
   ],
   "driverId": "claude-version-v1",
   "adapterFormat": "skill-directory-v1",
+  "verification": {
+    "driverId": "claude-code-print-v1",
+    "authStrategy": "existing-user-state",
+    "credentialMutation": "host-managed"
+  },
   "pathCategories": [
     {
       "id": "claude-user-skills",

package/data/hosts/codex/host-descriptor.json

@@ -10,6 +10,11 @@
   ],
   "driverId": "codex-version-v1",
   "adapterFormat": "skill-directory-v1",
+  "verification": {
+    "driverId": "codex-exec-v1",
+    "authStrategy": "existing-user-state",
+    "credentialMutation": "host-managed"
+  },
   "pathCategories": [
     {
       "id": "codex-user-skills",

package/data/hosts/qoder/host-descriptor.json

@@ -3,10 +3,24 @@
   "kind": "skill-family.host-descriptor",
   "hostId": "qoder",
   "displayName": "Qoder",
-  "support": "unsupported",
-  "maturity": "unsupported",
+  "support": "manual",
+  "maturity": "manual",
   "sourceAliases": [],
-  "unsupportedReason": "No auditable non-interactive host driver is frozen for this release.",
+  "verification": {
+    "driverId": "qodercli-print-v1",
+    "authStrategy": "existing-user-state",
+    "credentialMutation": "host-managed"
+  },
   "pathCategories": [],
-  "probeCapabilities": []
+  "probeCapabilities": [
+    "cli",
+    "version",
+    "payload",
+    "registry",
+    "discover",
+    "enabled",
+    "reload",
+    "smoke",
+    "uninstall"
+  ]
 }

package/docs/agents/capability-catalog.en.json

@@ -20,7 +20,7 @@
  "capabilities": [
   {
    "id": "foundation.contracts.object-validation",
-   "intent": "Compile and validate all 39 registered top-level Foundation contract object documents under both the draft-07 and 2020-12 dialects using Ajv 8.20.0 (exact pin).",
+   "intent": "Compile and validate all 42 registered top-level Foundation contract object documents under both the draft-07 and 2020-12 dialects using Ajv 8.20.0 (exact pin).",
    "useWhen": [
     "Need to validate registered contract objects such as project-manifest, profile-descriptor, report-model",
     "Need to detect the document dialect and select the strict or tolerant validation policy"
@@ -73,7 +73,7 @@
     "Need to find a kernel protocol definition by protocol name"
    ],
    "doNotUseWhen": [
-    "Need to add a registered top-level object without an ADR (the 39-object set is fixed)"
+    "Need to add a registered top-level object without an ADR (the 42-object set is fixed)"
    ],
    "prerequisites": [
     "registry.json is shipped with the package",
@@ -94,8 +94,8 @@
     "SFC1004: duplicate protocol registration"
    ],
    "invariants": [
-    "registry.json's schemaVersion=1 and contractsVersion=1.10.0 are the single authority",
-    "The set of 39 top-level objects is fixed; additions require an ADR"
+    "registry.json's schemaVersion=1 and contractsVersion are the single authority",
+    "The set of 42 top-level objects is fixed; additions require an ADR"
    ],
    "ownedByCaller": [
     "Interpretation of an object's business meaning"
@@ -568,7 +568,7 @@
   },
   {
    "id": "foundation.harness.host-adapter",
-  "intent": "Implement the generic mechanism layer for host integration: normalize adapter source, compute the build closure, validate the build manifest, verify peer adapter directories, materialize the build, and probe the version vector (spawn disabled by default).",
+   "intent": "Implement the generic mechanism layer for host integration: normalize adapter source, compute the build closure, validate the build manifest, verify peer adapter directories, materialize the build, and probe the version vector (spawn disabled by default).",
    "useWhen": [
     "Need to turn a host adapter source into a reproducible text closure",
     "Need to materialize build artifacts at a contained location",
@@ -922,7 +922,8 @@
     "The consumer supplies the command, cwd, and a timeout policy with maxSeconds and killGraceSeconds"
    ],
    "inputs": [
-    "Command/args/cwd, timeout policy, optional progress and terminal progress paths, optional budget and long-tool hooks, optional evidence path"
+    "Command/args/cwd, timeout policy, optional progress and terminal progress paths, optional budget and long-tool hooks, optional evidence path",
+    "The optional 0.13.0 outputByteLimits caps stdout and stderr independently by raw bytes. Equality is allowed; first excess uses the existing termination path. Without caps, no limit fields are added and legacy behavior remains."
    ],
    "outputs": [
     "One frozen watchdog-termination-envelope per call (single writer)"
@@ -1265,7 +1266,7 @@
   },
   {
    "id": "foundation.kit.host",
-  "intent": "Explicitly select a packaged or caller-provided finite host Profile set and trusted drivers, providing canonical identity resolution, describe/build/probe/plan, bounded local install/update, and read-only peer adapter verification; uninstall remains a manual-recovery refusal.",
+   "intent": "Explicitly select a packaged or caller-provided finite host Profile set and trusted drivers, providing canonical identity resolution, describe/build/probe/plan, bounded local install/update, and read-only peer adapter verification; uninstall remains a manual-recovery refusal.",
    "useWhen": [
     "Need to resolve a registered host or finite Profile alias",
     "Need to probe, build, plan, or locally install/update host integration",
@@ -1274,7 +1275,7 @@
    "doNotUseWhen": [
     "Need remote host publication, automatic trust, or uninstall deletion",
     "Need peer verification to decide domain semantics or to grant install/apply lifecycle support",
-    "Need a full Qoder driver (that host is unsupported)"
+    "Need a Qoder lifecycle driver (that host is manual and grants no lifecycle capability)"
    ],
    "prerequisites": [
     "The host Profile is registered in profiles/hosts and aliases are finite; npm consumers may explicitly select the Kit's packaged projection root",
@@ -1292,7 +1293,7 @@
     "verifyHostPeers reads caller-owned peer roots and writes no peer directory"
    ],
    "failureSemantics": [
-    "An unsupported host (e.g. qoder) returns an unsupported result",
+    "Hosts without a bound verification driver (e.g. codebuddy) are rejected before spawn with preflight-rejected",
     "Uninstall returns manual-recovery-required without deleting files",
     "Missing probe facts, unknown projection categories, identity spoofing, or scope/anchor conflicts fail closed"
    ],
@@ -1305,7 +1306,7 @@
    ],
    "routeElsewhere": [
     "Remote host publication and automatic trust: explicitly unsupported",
-    "Full Qoder driver: unsupported"
+    "Qoder lifecycle driver: unsupported"
    ]
   },
   {
@@ -1601,7 +1602,7 @@
     "Need to provide declarative data for host integration"
    ],
    "doNotUseWhen": [
-    "Need to register a full Qoder driver (that host is unsupported)"
+    "Need to register a Qoder lifecycle driver (that host is manual and registers only a verification driver)"
    ],
    "prerequisites": [
     "The host descriptor is bound to a trusted driverId"
@@ -1616,16 +1617,16 @@
     "No side effects (declared data)"
    ],
    "failureSemantics": [
-    "qoder is marked unsupported and manual hosts never acquire an implicit driver"
+    "qoder is marked manual and manual hosts never acquire an implicit lifecycle driver"
    ],
    "invariants": [
-    "claude/codex have support=supported and are bound to a driverId; manual hosts have no driver; qoder has support=unsupported"
+    "claude/codex have support=supported and are bound to a driverId; qoder has support=manual and binds only the verification driver (qodercli-print-v1), with no lifecycle driver"
    ],
    "ownedByCaller": [
     "Host business semantics"
    ],
    "routeElsewhere": [
-    "Full Qoder driver: unsupported"
+    "Qoder lifecycle driver: unsupported"
    ]
   },
   {
@@ -1692,38 +1693,6 @@
     "Host lifecycle: external tools or a later version"
    ]
   },
-  {
-   "id": "foundation.unsupported.qoder-driver",
-   "intent": "The full driver for the Qoder host is not frozen (No auditable non-interactive host driver is frozen), marked unsupported, referenced for structure only.",
-   "useWhen": [],
-   "doNotUseWhen": [
-    "Any scenario requiring actual execution on Qoder"
-   ],
-   "prerequisites": [
-    "none"
-   ],
-   "inputs": [
-    "none"
-   ],
-   "outputs": [
-    "none (unsupported)"
-   ],
-   "sideEffects": [
-    "none"
-   ],
-   "failureSemantics": [
-    "Referencing the qoder driver throws"
-   ],
-   "invariants": [
-    "HOST_DRIVER_IDS contains only claude-version-v1 / codex-version-v1"
-   ],
-   "ownedByCaller": [
-    "Qoder integration"
-   ],
-   "routeElsewhere": [
-    "Qoder support: a later version or external"
-   ]
-  },
   {
    "id": "foundation.unsupported.binary-adapter-source",
    "intent": "The adapter source content supports only string (utf8 text closure); binary projection is out of scope.",
@@ -1916,6 +1885,40 @@
     "Git write operations: the Git lifecycle guide"
    ]
   },
+  {
+   "id": "foundation.kit.qoder-verification",
+   "intent": "Qoder has been a manual host (descriptor maturity=manual) since 0.12.0: one constrained real-host verification runs through the frozen qodercli-print-v1 verification driver (capability stability=candidate) in a fresh workspace",
+   "useWhen": [
+    "Need to request Qoder candidate real-host verification for upgraded consumers"
+   ],
+   "doNotUseWhen": [
+    "Need Qoder build, plan, apply, generic install/update/uninstall, or rollback lifecycle capability"
+   ],
+   "prerequisites": [
+    "The qoder executable exists and is logged in; qoder static preflight and fresh-workspace layout checks pass"
+   ],
+   "inputs": [
+    "Qoder host Profile and verification driver binding"
+   ],
+   "outputs": [
+    "A single constrained real-execution observed, failed, or rejected result (quota and error-code details stay out of the public result)"
+   ],
+   "sideEffects": [
+    "Runs one qoder CLI execution in a fresh workspace; writes private evidence and snapshots"
+   ],
+   "failureSemantics": [
+    "Static preflight failures reject before spawn with preflight-rejected; execution failures such as quota exhaustion are marked execution-failed"
+   ],
+   "invariants": [
+    "qoder gains no lifecycle driver; all nine probe facts remain unknown/driver-limited"
+   ],
+   "ownedByCaller": [
+    "Qoder integration and the real release gate"
+   ],
+   "routeElsewhere": [
+    "Qoder lifecycle capability: external tools or a later version"
+   ]
+  },
   {
    "id": "foundation.contracts.quickstart-profile-candidate",
    "intent": "Expose the Quickstart Profile v2 protocol, canonical-$id Schema collection, and frozen eight-entry historical-ID migration map through skill-family-contracts/quickstart-profile for exact-version integration trials.",
@@ -1947,7 +1950,7 @@
    ],
    "invariants": [
     "The sole business-neutral operation is execute-method; method identifiers and domain schemas remain consumer-owned",
-    "Candidate schemas remain absent from src/registry.json and do not expand the 39 stable object classes",
+    "Candidate schemas remain absent from src/registry.json and do not expand the 42 stable object classes",
     "Stability is candidate: actively upgrading the candidate version requires contract verification",
     "Historical entrypoints and eight Schema IDs migrate once; stable promotion requires no further contract-identity change, while obtaining the new published promise still requires exact-pin updates"
    ],
@@ -2057,6 +2060,93 @@
     "Ordinary managed projection: use runProjection from the stable Kit root export",
     "Remote publication: route to release-skill"
    ]
+  },
+  {
+   "id": "foundation.harness.filesystem-tree-observation",
+   "intent": "Read a complete bound tree and leave payload acceptance to the caller",
+   "useWhen": [
+    "Need regular-file, directory, empty-directory and mode facts",
+    "Need a fresh observation using the same approved root binding"
+   ],
+   "doNotUseWhen": [
+    "Need installation, recovery or deletion",
+    "Need a transaction snapshot or continuous path identity protection"
+   ],
+   "prerequisites": [
+    "A canonical real root and its createFilesystemRootBinding result",
+    "The packaged native implementation supports the current Darwin/Linux platform"
+   ],
+   "inputs": [
+    "{ root, rootBinding }"
+   ],
+   "outputs": [
+    "Private filesystem-tree-observation: sorted members, contentBase64 from actual file bytes, sha256, bytes, statMode and membersDigest"
+   ],
+   "sideEffects": [
+    "Read-only filesystem access; no writes, processes or network"
+   ],
+   "failureSemantics": [
+    "Invalid parameters throw TypeError; mechanism failures fail closed through SFC2004",
+    "Partial member sets are not successful results"
+   ],
+   "invariants": [
+    "Every call observes the tree again without cached results",
+    "Observation success and payload acceptance remain separate",
+    "No ignore policy, expected-member table or callbacks"
+   ],
+   "ownedByCaller": [
+    "Payload acceptance policy and business meaning",
+    "Protection of sensitive observation data"
+   ],
+   "routeElsewhere": [
+    "Use Kit plugin verification for installation and invocation",
+    "Release authorization belongs to release-skill"
+   ]
+  },
+  {
+   "id": "foundation.kit.plugin-verification",
+   "intent": "Preserve the complete plugin layout and report input, installation, discovery and bounded invocation facts separately",
+   "useWhen": [
+    "Need frozen local payload or finite public-channel plugin verification",
+    "Need installation observations without transferring domain acceptance"
+   ],
+   "doNotUseWhen": [
+    "Need arbitrary drivers, retry, recovery or rollback",
+    "Need Foundation to approve domain output or publication"
+   ],
+   "prerequisites": [
+    "Exact lockstep package versions, a frozen request, private bindings and hostsRoot",
+    "Each actual host/source combination needs separate qualification evidence; an exported candidate API is not qualification"
+   ],
+   "inputs": [
+    "runPluginVerification({ request, bindings, hostsRoot })",
+    "plugin-verification-request: install-only or install-and-invoke; local-staged or public-channel"
+   ],
+   "outputs": [
+    "plugin-verification-result with separate input, installation, discovery and invocation facts",
+    "Raw streams and complete tree observations under private evidence roots"
+   ],
+   "sideEffects": [
+    "Creates a fresh installation, session and private evidence; finite channel commands may access the network",
+    "Invocation mode starts a constrained host; install-only makes no model call"
+   ],
+   "failureSemantics": [
+    "rejected, failed and indeterminate distinguish refusal, determined failure and unknown boundary state",
+    "A determined output limit breach cannot become success; unknown terminal state remains indeterminate"
+   ],
+   "invariants": [
+    "No overwrite of existing installations, automatic retry or cleanup of unknown state",
+    "Existing single-Skill runHostVerification and verifyHostVerificationBindings contracts remain intact",
+    "Complete tree observations do not replace caller acceptance policy"
+   ],
+   "ownedByCaller": [
+    "Source freezing, workload, authorization, authentication and host qualification",
+    "Domain acceptance, release freshness, migration and mechanism removal evidence"
+   ],
+   "routeElsewhere": [
+    "Domain review belongs to the consumer",
+    "Publication, retry and task orchestration belong to their external skill families"
+   ]
   }
  ]
 }