skill-family-engineering-kit 0.12.0 → 0.13.0

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.13.0 locale=en baseline=sha256:b9eed0b2361ff46c23ddd903b98b7059d9ceed8329f846010cb4a943101ec9a3 -->
+## [0.13.0] - 2026-08-26
+
+Engineering Kit 0.13.0 is a source candidate for complete plugin verification with separate installation, discovery and invocation facts.
+
+### Added
+
+- Adds the permanent candidate root entry runPluginVerification({ request, bindings, hostsRoot }).
+- Preserves complete plugin layouts and exposes installation observations without taking over caller acceptance policy.
+
+### Upgrade Notes
+
+Pin the three packages together. Existing runHostVerification and verifyHostVerificationBindings remain available for single-Skill verification. Every actual host/source combination still needs qualification; no publication or consumer mechanism removal is implied.
+<!-- release-skill:changelog:end version=0.13.0 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.12.0 locale=en baseline=sha256:6000579dc8b473dbeda1832274d971df0c4f3a62a90c973184dd70e59ffc8602 -->
 ## [0.12.0] - 2026-08-26
 

package/CHANGELOG.zh-CN.md

@@ -1,5 +1,21 @@
 # 变更日志
 
+<!-- release-skill:changelog:start version=0.13.0 locale=zh-CN baseline=sha256:3493c49151b2ebabddcba806d892ce967c0ae47621b0b2c75086e1cac334ebf9 -->
+## [0.13.0] - 2026-08-26
+
+Engineering Kit 0.13.0 源码候选增加完整插件验证，分别报告安装、发现和调用事实。
+
+### 新增
+
+- 新增永久候选根入口 runPluginVerification({ request, bindings, hostsRoot })。
+- 保留完整插件布局并提供安装观察，载荷接受政策仍由调用方决定。
+
+### 升级说明
+
+三个包须精确锁步。runHostVerification 与 verifyHostVerificationBindings 继续用于单 Skill 验证。每个真实宿主与来源组合仍须取得资格证据；本次不代表发布完成或消费者机制已退出。
+<!-- release-skill:changelog:end version=0.13.0 locale=zh-CN -->
+
+
 <!-- release-skill:changelog:start version=0.12.0 locale=zh-CN baseline=sha256:f2a68cdeac0b2a44d7a4cc64df8e8f371795b4150719d821a31866a6e8873e2f -->
 ## [0.12.0] - 2026-08-26
 

package/README.md

@@ -4,32 +4,23 @@
 
 # skill-family-engineering-kit
 
-<!-- release-skill:release-version: 0.12.0 -->
+<!-- release-skill:release-version: 0.13.0 -->
 
 An engineering toolkit used in development and CI. There are **exactly four** top-level commands, and no fifth:
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.12.0** (2026-08-26)
+**0.13.0** (2026-08-26)
 
-Engineering Kit 0.12.0 extends bounded real-host verification from two to five fixed built-in drivers.
+Engineering Kit 0.13.0 is a source candidate for complete plugin verification with separate installation, discovery and invocation facts.
 
 **Added**
 
-- Extends runHostVerification with three fixed built-in drivers while retaining the Kimi and WorkBuddy raw-byte behavior.
-
-**Changed**
-
-- Uses the classic plugin-root/skills/skill-id layout for the plugin-directory driver and validates complete JSONL event streams before accepting execution.
-- Keeps output meaning with consumers and applies strict text decoding only to the three new text-protocol drivers.
-- Registers Qoder as manual for host support and descriptor maturity, while its real-host verification capability remains candidate.
-
-**Fixed**
-
-- Rejects malformed protocol tails, invalid UTF-8 in text-protocol drivers, and version suffixes outside each driver's fixed format before they can support a successful public result.
+- Adds the permanent candidate root entry runPluginVerification({ request, bindings, hostsRoot }).
+- Preserves complete plugin layouts and exposes installation observations without taking over caller acceptance policy.
 
 **Upgrade Notes**
 
-Pin all three Foundation packages to 0.12.0. Existing runHostVerification and verifyHostVerificationBindings entrypoints and request identities remain unchanged. Reuse the host's existing login state; Foundation does not isolate authentication, freeze model identity, disable host tools, or decide domain PASS/FAIL. Qoder verification grants no build, plan, apply, install, update, uninstall, or rollback capability. The executable digest is a preflight observation and member snapshots cover only the declared members at the two observed times.
+Pin the three packages together. Existing runHostVerification and verifyHostVerificationBindings remain available for single-Skill verification. Every actual host/source combination still needs qualification; no publication or consumer mechanism removal is implied.
 <!-- release-skill:managed:end id=latest-release -->
 
 | Command | Purpose | Side effects |
@@ -49,8 +40,10 @@ Kit is the "engineering stage" layer, depending on the Harness and Contracts. It
 
 ## Installation and Minimal Example
 
+Version 0.13.0 is not published. The registry command below is for use after publication; this iteration installs the three local candidate tarballs in an isolated directory.
+
 ```sh
-npm install --save-dev skill-family-engineering-kit@0.12.0
+npm install --save-dev skill-family-engineering-kit@0.13.0
 npm exec -- skill-family-kit --help
 npm exec -- skill-family-kit scaffold --root <empty-dir> --project-id my-project
 npm exec -- skill-family-kit adopt-plan --root <repo>
@@ -58,7 +51,7 @@ npm exec -- skill-family-kit projection --root <repo>
 npm exec -- skill-family-kit check --root <repo>
 ```
 
-The four commands above cover skeleton generation, read-only inventory, managed projection, and diagnostics respectively; a zero-install form is available via `npm exec --package=skill-family-engineering-kit@0.12.0 -- skill-family-kit --help`.
+The four commands above cover skeleton generation, read-only inventory, managed projection, and diagnostics respectively; a zero-install form is available via `npm exec --package=skill-family-engineering-kit@0.13.0 -- skill-family-kit --help`.
 
 ### Public Profile SPI
 
@@ -238,3 +231,9 @@ This package must not perform git init, commit, push, tag, stash, branch switch,
 - Package-local source: `src/*.mjs`.
 - Package-local candidate source: `candidate/*`; canonical public imports: `skill-family-engineering-kit/quickstart-profile`, `/adoption`, and `/skill-naming`; historical migration alias: `skill-family-engineering-kit/candidate/quickstart-profile`.
 <!-- agent-quick-reference:end -->
+
+## Complete Plugin Candidate
+
+The candidate runPluginVerification({ request, bindings, hostsRoot }) preserves a complete plugin layout and separates installation, discovery and invocation facts. Each actual host/source combination still needs qualification evidence.
+
+Version 0.13.0 is a local source candidate and is not published. Consume the three locally verified tarballs; a version marker, unit test or successful install is not complete host qualification or release approval.

package/README.zh-CN.md

@@ -5,32 +5,23 @@
 
 # skill-family-engineering-kit
 
-<!-- release-skill:release-version: 0.12.0 -->
+<!-- release-skill:release-version: 0.13.0 -->
 
 开发与 CI 阶段使用的工程工具包。**恰好四个**顶层命令，没有第五个：
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.12.0** (2026-08-26)
+**0.13.0** (2026-08-26)
 
-Engineering Kit 0.12.0 将受约束真实宿主验证从两个固定内置驱动扩展为五个。
+Engineering Kit 0.13.0 源码候选增加完整插件验证，分别报告安装、发现和调用事实。
 
 **新增**
 
-- 为 runHostVerification 增加三个固定的内置驱动，保留 Kimi 与 WorkBuddy 的原始字节行为。
-
-**变更**
-
-- 插件目录驱动使用 plugin-root/skills/skill-id 经典插件布局；JSONL 驱动必须扫描完整事件流后才接受执行结果。
-- 输出的业务含义由消费者判断，严格文本解码仅用于三个新增的文本协议驱动。
-- Qoder 的宿主支持和 Descriptor 成熟度登记为 manual，真实宿主验证能力继续标为 candidate。
-
-**修复**
-
-- 拒绝畸形协议尾部、文本协议中的非法 UTF-8，以及驱动固定格式之外的版本后缀，避免产生错误的公共成功结果。
+- 新增永久候选根入口 runPluginVerification({ request, bindings, hostsRoot })。
+- 保留完整插件布局并提供安装观察，载荷接受政策仍由调用方决定。
 
 **升级说明**
 
-三个 Foundation 包须精确锁定到同一 0.12.0 版本。runHostVerification、verifyHostVerificationBindings 入口与请求身份不变。验证复用宿主现有登录态；Foundation 不隔离认证、不固定模型身份、不关闭宿主工具，也不判定领域 PASS/FAIL。Qoder 验证不授予 build、plan、apply、install、update、uninstall 或 rollback 能力。可执行文件摘要仅是启动前观察，成员快照仅覆盖已声明成员的两个观察时点。
+三个包须精确锁步。runHostVerification 与 verifyHostVerificationBindings 继续用于单 Skill 验证。每个真实宿主与来源组合仍须取得资格证据；本次不代表发布完成或消费者机制已退出。
 <!-- release-skill:managed:end id=latest-release -->
 
 | 命令 | 用途 | 副作用 |
@@ -50,8 +41,10 @@ Kit 是「工程阶段」层，依赖 Harness 与 Contracts。它只做四件事
 
 ## 安装和最小示例
 
+0.13.0 尚未发布。下面的 registry 安装命令供发布后使用；本轮验证应在隔离目录安装三个本地候选 tarball。
+
 ```sh
-npm install --save-dev skill-family-engineering-kit@0.12.0
+npm install --save-dev skill-family-engineering-kit@0.13.0
 npm exec -- skill-family-kit --help
 npm exec -- skill-family-kit scaffold --root <empty-dir> --project-id my-project
 npm exec -- skill-family-kit adopt-plan --root <repo>
@@ -59,7 +52,7 @@ npm exec -- skill-family-kit projection --root <repo>
 npm exec -- skill-family-kit check --root <repo>
 ```
 
-以上四条命令分别覆盖生成骨架、只读盘点、受管投影与诊断；零安装形式可用 `npm exec --package=skill-family-engineering-kit@0.12.0 -- skill-family-kit --help`。
+以上四条命令分别覆盖生成骨架、只读盘点、受管投影与诊断；零安装形式可用 `npm exec --package=skill-family-engineering-kit@0.13.0 -- skill-family-kit --help`。
 
 ### 公共 Profile SPI
 
@@ -247,3 +240,9 @@ projection 只写同时满足两个条件的路径：manifest 列出，且目标
 - 包内源：`src/*.mjs`。
 - 包内 Candidate 源：`candidate/*`；规范公共导入：`skill-family-engineering-kit/quickstart-profile`、`/adoption` 与 `/skill-naming`；历史迁移别名：`skill-family-engineering-kit/candidate/quickstart-profile`。
 <!-- agent-quick-reference:end -->
+
+## 完整插件候选能力
+
+新增候选 runPluginVerification({ request, bindings, hostsRoot })，保留完整插件布局并分别报告安装、发现与调用事实。真实宿主与来源组合仍需独立资格证据。
+
+0.13.0 为本地源码候选，尚未发布。消费本地已验证的三包 tarball，不能把版本标记、单元测试或安装成功当作完整宿主资格与发布批准。

package/SECURITY.md

@@ -4,10 +4,10 @@
 
 | 版本 | 安全支持状态 |
 | --- | --- |
-| 0.1.x | 当前维护线：接受安全报告 |
+| 0.13.x | 当前维护线：接受安全报告 |
 | 0.0.0 | 未发布的内部骨架版本，不在公开支持范围 |
 
-安全修复只承诺在最新的 0.1.x 线上提供；更早版本不回移修复。
+安全修复只承诺在最新的 0.13.x 线上提供；更早版本不回移修复。
 
 ## 报告漏洞
 

package/docs/agents/capability-catalog.en.json

@@ -20,7 +20,7 @@
  "capabilities": [
   {
    "id": "foundation.contracts.object-validation",
-   "intent": "Compile and validate all 39 registered top-level Foundation contract object documents under both the draft-07 and 2020-12 dialects using Ajv 8.20.0 (exact pin).",
+   "intent": "Compile and validate all 42 registered top-level Foundation contract object documents under both the draft-07 and 2020-12 dialects using Ajv 8.20.0 (exact pin).",
    "useWhen": [
     "Need to validate registered contract objects such as project-manifest, profile-descriptor, report-model",
     "Need to detect the document dialect and select the strict or tolerant validation policy"
@@ -73,7 +73,7 @@
     "Need to find a kernel protocol definition by protocol name"
    ],
    "doNotUseWhen": [
-    "Need to add a registered top-level object without an ADR (the 39-object set is fixed)"
+    "Need to add a registered top-level object without an ADR (the 42-object set is fixed)"
    ],
    "prerequisites": [
     "registry.json is shipped with the package",
@@ -94,8 +94,8 @@
     "SFC1004: duplicate protocol registration"
    ],
    "invariants": [
-    "registry.json's schemaVersion=1 and contractsVersion=1.10.0 are the single authority",
-    "The set of 39 top-level objects is fixed; additions require an ADR"
+    "registry.json's schemaVersion=1 and contractsVersion are the single authority",
+    "The set of 42 top-level objects is fixed; additions require an ADR"
    ],
    "ownedByCaller": [
     "Interpretation of an object's business meaning"
@@ -568,7 +568,7 @@
   },
   {
    "id": "foundation.harness.host-adapter",
-  "intent": "Implement the generic mechanism layer for host integration: normalize adapter source, compute the build closure, validate the build manifest, verify peer adapter directories, materialize the build, and probe the version vector (spawn disabled by default).",
+   "intent": "Implement the generic mechanism layer for host integration: normalize adapter source, compute the build closure, validate the build manifest, verify peer adapter directories, materialize the build, and probe the version vector (spawn disabled by default).",
    "useWhen": [
     "Need to turn a host adapter source into a reproducible text closure",
     "Need to materialize build artifacts at a contained location",
@@ -922,7 +922,8 @@
     "The consumer supplies the command, cwd, and a timeout policy with maxSeconds and killGraceSeconds"
    ],
    "inputs": [
-    "Command/args/cwd, timeout policy, optional progress and terminal progress paths, optional budget and long-tool hooks, optional evidence path"
+    "Command/args/cwd, timeout policy, optional progress and terminal progress paths, optional budget and long-tool hooks, optional evidence path",
+    "The optional 0.13.0 outputByteLimits caps stdout and stderr independently by raw bytes. Equality is allowed; first excess uses the existing termination path. Without caps, no limit fields are added and legacy behavior remains."
    ],
    "outputs": [
     "One frozen watchdog-termination-envelope per call (single writer)"
@@ -1265,7 +1266,7 @@
   },
   {
    "id": "foundation.kit.host",
-  "intent": "Explicitly select a packaged or caller-provided finite host Profile set and trusted drivers, providing canonical identity resolution, describe/build/probe/plan, bounded local install/update, and read-only peer adapter verification; uninstall remains a manual-recovery refusal.",
+   "intent": "Explicitly select a packaged or caller-provided finite host Profile set and trusted drivers, providing canonical identity resolution, describe/build/probe/plan, bounded local install/update, and read-only peer adapter verification; uninstall remains a manual-recovery refusal.",
    "useWhen": [
     "Need to resolve a registered host or finite Profile alias",
     "Need to probe, build, plan, or locally install/update host integration",
@@ -1949,7 +1950,7 @@
    ],
    "invariants": [
     "The sole business-neutral operation is execute-method; method identifiers and domain schemas remain consumer-owned",
-    "Candidate schemas remain absent from src/registry.json and do not expand the 39 stable object classes",
+    "Candidate schemas remain absent from src/registry.json and do not expand the 42 stable object classes",
     "Stability is candidate: actively upgrading the candidate version requires contract verification",
     "Historical entrypoints and eight Schema IDs migrate once; stable promotion requires no further contract-identity change, while obtaining the new published promise still requires exact-pin updates"
    ],
@@ -2059,6 +2060,93 @@
     "Ordinary managed projection: use runProjection from the stable Kit root export",
     "Remote publication: route to release-skill"
    ]
+  },
+  {
+   "id": "foundation.harness.filesystem-tree-observation",
+   "intent": "Read a complete bound tree and leave payload acceptance to the caller",
+   "useWhen": [
+    "Need regular-file, directory, empty-directory and mode facts",
+    "Need a fresh observation using the same approved root binding"
+   ],
+   "doNotUseWhen": [
+    "Need installation, recovery or deletion",
+    "Need a transaction snapshot or continuous path identity protection"
+   ],
+   "prerequisites": [
+    "A canonical real root and its createFilesystemRootBinding result",
+    "The packaged native implementation supports the current Darwin/Linux platform"
+   ],
+   "inputs": [
+    "{ root, rootBinding }"
+   ],
+   "outputs": [
+    "Private filesystem-tree-observation: sorted members, contentBase64 from actual file bytes, sha256, bytes, statMode and membersDigest"
+   ],
+   "sideEffects": [
+    "Read-only filesystem access; no writes, processes or network"
+   ],
+   "failureSemantics": [
+    "Invalid parameters throw TypeError; mechanism failures fail closed through SFC2004",
+    "Partial member sets are not successful results"
+   ],
+   "invariants": [
+    "Every call observes the tree again without cached results",
+    "Observation success and payload acceptance remain separate",
+    "No ignore policy, expected-member table or callbacks"
+   ],
+   "ownedByCaller": [
+    "Payload acceptance policy and business meaning",
+    "Protection of sensitive observation data"
+   ],
+   "routeElsewhere": [
+    "Use Kit plugin verification for installation and invocation",
+    "Release authorization belongs to release-skill"
+   ]
+  },
+  {
+   "id": "foundation.kit.plugin-verification",
+   "intent": "Preserve the complete plugin layout and report input, installation, discovery and bounded invocation facts separately",
+   "useWhen": [
+    "Need frozen local payload or finite public-channel plugin verification",
+    "Need installation observations without transferring domain acceptance"
+   ],
+   "doNotUseWhen": [
+    "Need arbitrary drivers, retry, recovery or rollback",
+    "Need Foundation to approve domain output or publication"
+   ],
+   "prerequisites": [
+    "Exact lockstep package versions, a frozen request, private bindings and hostsRoot",
+    "Each actual host/source combination needs separate qualification evidence; an exported candidate API is not qualification"
+   ],
+   "inputs": [
+    "runPluginVerification({ request, bindings, hostsRoot })",
+    "plugin-verification-request: install-only or install-and-invoke; local-staged or public-channel"
+   ],
+   "outputs": [
+    "plugin-verification-result with separate input, installation, discovery and invocation facts",
+    "Raw streams and complete tree observations under private evidence roots"
+   ],
+   "sideEffects": [
+    "Creates a fresh installation, session and private evidence; finite channel commands may access the network",
+    "Invocation mode starts a constrained host; install-only makes no model call"
+   ],
+   "failureSemantics": [
+    "rejected, failed and indeterminate distinguish refusal, determined failure and unknown boundary state",
+    "A determined output limit breach cannot become success; unknown terminal state remains indeterminate"
+   ],
+   "invariants": [
+    "No overwrite of existing installations, automatic retry or cleanup of unknown state",
+    "Existing single-Skill runHostVerification and verifyHostVerificationBindings contracts remain intact",
+    "Complete tree observations do not replace caller acceptance policy"
+   ],
+   "ownedByCaller": [
+    "Source freezing, workload, authorization, authentication and host qualification",
+    "Domain acceptance, release freshness, migration and mechanism removal evidence"
+   ],
+   "routeElsewhere": [
+    "Domain review belongs to the consumer",
+    "Publication, retry and task orchestration belong to their external skill families"
+   ]
   }
  ]
 }

package/docs/agents/capability-catalog.json

@@ -370,15 +370,15 @@
     "materializeAdapterBuild (packages/skill-family-harness-node/src/host.mjs)",
     "probeVersionVector (packages/skill-family-harness-node/src/host.mjs)"
    ],
-  "sourceRefs": [
+   "sourceRefs": [
     "packages/skill-family-harness-node/src/host.mjs",
     "packages/skill-family-harness-node/src/peer-adapter.mjs"
-  ],
-  "positiveTestRefs": [
+   ],
+   "positiveTestRefs": [
     "packages/skill-family-harness-node/test/host.test.mjs",
     "packages/skill-family-harness-node/test/peer-adapter.test.mjs"
-  ],
-  "negativeTestRefs": [
+   ],
+   "negativeTestRefs": [
     "packages/skill-family-harness-node/test/host.test.mjs",
     "packages/skill-family-harness-node/test/peer-adapter.test.mjs"
    ]
@@ -1299,6 +1299,51 @@
     "packages/skill-family-engineering-kit/test/candidate-skill-naming.test.mjs",
     "packages/skill-family-engineering-kit/test/candidate-promotion-compatibility.test.mjs"
    ]
+  },
+  {
+   "id": "foundation.harness.filesystem-tree-observation",
+   "package": "skill-family-harness-node",
+   "layer": "harness",
+   "since": "0.13.0",
+   "stability": "candidate",
+   "entrypoints": [
+    "skill-family-harness-node: observeFilesystemTree (packages/skill-family-harness-node/src/filesystem-observation.mjs)"
+   ],
+   "sourceRefs": [
+    "packages/skill-family-harness-node/src/filesystem-observation.mjs",
+    "packages/skill-family-harness-node/src/native/bound_read.c"
+   ],
+   "positiveTestRefs": [
+    "packages/skill-family-engineering-kit/test/plugin-verification.test.mjs"
+   ],
+   "negativeTestRefs": [
+    "packages/skill-family-engineering-kit/test/plugin-verification.test.mjs"
+   ],
+   "migration": "none",
+   "promotionPolicy": "consumer-transparent"
+  },
+  {
+   "id": "foundation.kit.plugin-verification",
+   "package": "skill-family-engineering-kit",
+   "layer": "engineering-kit",
+   "since": "0.13.0",
+   "stability": "candidate",
+   "entrypoints": [
+    "skill-family-engineering-kit: runPluginVerification (packages/skill-family-engineering-kit/src/plugin-verification.mjs)"
+   ],
+   "sourceRefs": [
+    "packages/skill-family-engineering-kit/src/plugin-verification.mjs",
+    "packages/skill-family-contracts/src/schemas/plugin-verification-request.schema.json",
+    "packages/skill-family-contracts/src/schemas/plugin-verification-result.schema.json"
+   ],
+   "positiveTestRefs": [
+    "packages/skill-family-engineering-kit/test/plugin-verification.test.mjs"
+   ],
+   "negativeTestRefs": [
+    "packages/skill-family-engineering-kit/test/plugin-verification.test.mjs"
+   ],
+   "migration": "none",
+   "promotionPolicy": "consumer-transparent"
   }
  ]
 }

package/docs/agents/capability-catalog.zh-CN.json

@@ -20,7 +20,7 @@
  "capabilities": [
   {
    "id": "foundation.contracts.object-validation",
-   "intent": "用 Ajv 8.20.0（精确 pin）在 draft-07 与 2020-12 双方言下编译并校验 Foundation 已登记的全部 39 类顶层契约对象文档",
+   "intent": "用 Ajv 8.20.0（精确 pin）在 draft-07 与 2020-12 双方言下编译并校验 Foundation 已登记的全部 42 类顶层契约对象文档",
    "useWhen": [
     "需要校验 project-manifest、profile-descriptor、report-model 等已登记契约对象",
     "需要探测文档方言并选择 strict 或 tolerant 校验策略"
@@ -73,7 +73,7 @@
     "需要按协议名查找 kernel 协议定义"
    ],
    "doNotUseWhen": [
-    "需要在没有 ADR 的情况下新增顶层登记对象（39 类对象集已经固定）"
+    "需要在没有 ADR 的情况下新增顶层登记对象（42 类对象集已经固定）"
    ],
    "prerequisites": [
     "registry.json 已随包发布",
@@ -94,8 +94,8 @@
     "SFC1004：重复协议登记"
    ],
    "invariants": [
-    "registry.json 的 schemaVersion=1、contractsVersion=1.10.0 为唯一权威",
-    "39 类顶层对象集合固定，新增需 ADR"
+    "registry.json 的 schemaVersion=1、contractsVersion 为唯一权威",
+    "42 类顶层对象集合固定，新增需 ADR"
    ],
    "ownedByCaller": [
     "对象业务含义的解释"
@@ -568,7 +568,7 @@
   },
   {
    "id": "foundation.harness.host-adapter",
-  "intent": "实现宿主接入的通用机制层：归一化 adapter source、计算构建闭包、校验构建清单、验证同级适配器目录、materialize 构建、probe 版本向量（默认禁 spawn）",
+   "intent": "实现宿主接入的通用机制层：归一化 adapter source、计算构建闭包、校验构建清单、验证同级适配器目录、materialize 构建、probe 版本向量（默认禁 spawn）",
    "useWhen": [
     "需要把宿主适配源做成可复算的文本闭包",
     "需要在受收容处 materialize 构建产物",
@@ -922,7 +922,8 @@
     "消费者提供命令、cwd 与含 maxSeconds 和 killGraceSeconds 的超时策略"
    ],
    "inputs": [
-    "命令/参数/cwd、超时策略、可选的进度与终态进度路径、可选的预算与长工具钩子、可选的证据路径"
+    "命令/参数/cwd、超时策略、可选的进度与终态进度路径、可选的预算与长工具钩子、可选的证据路径",
+    "0.13.0 可选 outputByteLimits 分别限制 stdout/stderr 原始字节；等于上限允许，首次超过上限启动既有终止路径。未配置时不追加限额字段，保持旧行为。"
    ],
    "outputs": [
     "每次调用恰好一个冻结的 watchdog-termination-envelope（单写者）"
@@ -1265,7 +1266,7 @@
   },
   {
    "id": "foundation.kit.host",
-  "intent": "显式选择随包或调用方提供的有限宿主 Profile 集合与受信 driver，提供规范身份解析、describe/build/probe/plan、受限的本地 install/update 以及只读同级适配器验证；uninstall 始终要求人工恢复",
+   "intent": "显式选择随包或调用方提供的有限宿主 Profile 集合与受信 driver，提供规范身份解析、describe/build/probe/plan、受限的本地 install/update 以及只读同级适配器验证；uninstall 始终要求人工恢复",
    "useWhen": [
     "需要解析已登记宿主或有限 Profile alias",
     "需要探测、构建、规划或本地 install/update 宿主接入",
@@ -1949,7 +1950,7 @@
    ],
    "invariants": [
     "唯一业务中立操作为 execute-method；method 标识与领域 Schema 继续归消费者所有",
-    "候选 Schema 不进入 src/registry.json，也不扩张 39 类稳定对象",
+    "候选 Schema 不进入 src/registry.json，也不扩张 42 类稳定对象",
     "稳定性为 candidate：主动升级候选版本时须复验合同",
     "历史入口和八个 Schema ID 只迁移一次；晋升 stable 不再要求改合同身份，但取得新发布承诺仍须更新精确 pin"
    ],
@@ -2059,6 +2060,93 @@
     "普通受管投影：使用 Kit 稳定包根导出的 runProjection",
     "远端发布：转 release-skill"
    ]
+  },
+  {
+   "id": "foundation.harness.filesystem-tree-observation",
+   "intent": "从已绑定目录读取同次完整树事实，供消费者自行判断载荷是否可接受",
+   "useWhen": [
+    "需要读取普通文件、目录、空目录和权限事实",
+    "需要在同一根绑定下重新观察实际内容"
+   ],
+   "doNotUseWhen": [
+    "需要安装、恢复或删除目录",
+    "需要事务快照或操作期间连续身份保护"
+   ],
+   "prerequisites": [
+    "已规范化真实根目录和 createFilesystemRootBinding 返回的根绑定",
+    "包内固定 Darwin/Linux 四平台原生实现可用"
+   ],
+   "inputs": [
+    "{ root, rootBinding }"
+   ],
+   "outputs": [
+    "filesystem-tree-observation 私有对象：排序成员、文件原始字节的 contentBase64、sha256、bytes、statMode 及 membersDigest"
+   ],
+   "sideEffects": [
+    "只读文件系统访问，不写文件、不启动进程、不访问网络"
+   ],
+   "failureSemantics": [
+    "非法参数抛 TypeError；机制失败沿 SFC2004 失败关闭",
+    "不返回部分成员作为成功结果"
+   ],
+   "invariants": [
+    "每次调用重新观察，不返回旧缓存",
+    "观察成功与消费者接受载荷分离",
+    "不接收忽略规则、预期表或回调"
+   ],
+   "ownedByCaller": [
+    "载荷比较政策及其业务含义",
+    "保存或公开结果时的敏感数据保护"
+   ],
+   "routeElsewhere": [
+    "安装与调用使用 Kit 的插件验证入口",
+    "发布授权由 release-skill 负责"
+   ]
+  },
+  {
+   "id": "foundation.kit.plugin-verification",
+   "intent": "保留完整插件布局，分别报告输入、安装、发现与受限调用事实",
+   "useWhen": [
+    "需要验证冻结完整插件的本地载荷或有限公共渠道安装",
+    "需要把安装观察与领域接受判断分开"
+   ],
+   "doNotUseWhen": [
+    "需要通用驱动插件、自动重试、恢复或回滚",
+    "需要由 Foundation 判定领域通过或发布完成"
+   ],
+   "prerequisites": [
+    "三包精确版本一致，并提供冻结请求、私有路径绑定及 hostsRoot",
+    "真实宿主和来源组合须另有资格证据；候选入口存在不等于组合已获资格"
+   ],
+   "inputs": [
+    "runPluginVerification({ request, bindings, hostsRoot })",
+    "plugin-verification-request：install-only 或 install-and-invoke；local-staged 或 public-channel"
+   ],
+   "outputs": [
+    "plugin-verification-result：输入、安装、发现及调用事实分别记录",
+    "原始输出和完整树观察保留在私有证据根"
+   ],
+   "sideEffects": [
+    "创建新鲜安装树、会话与私有证据；有限渠道命令可能访问网络",
+    "调用模式启动受限宿主；install-only 不运行模型"
+   ],
+   "failureSemantics": [
+    "rejected、failed、indeterminate 分别保留拒绝、确定失败与边界不确定",
+    "确定输出超限不能恢复为成功；未知终态保持不确定"
+   ],
+   "invariants": [
+    "不覆盖已有安装，不自动重试或清理不确定现场",
+    "保留 runHostVerification 和 verifyHostVerificationBindings 的单 Skill 合同",
+    "完整树事实不替代消费者接受政策"
+   ],
+   "ownedByCaller": [
+    "冻结源、工作负载、授权、认证与宿主资格",
+    "领域判定、发布新鲜度、迁移及机制退出证明"
+   ],
+   "routeElsewhere": [
+    "领域审阅交消费者",
+    "发布、重试和任务编排交对应外部技能族"
+   ]
   }
  ]
 }

package/docs/architecture/index.html

@@ -2108,12 +2108,12 @@ operation。后续晋升 stable 只提高兼容承诺，不再触发消费者源
 <p>三包结构保持、不拆第四包（FND-ADR-007）；制品治理采用 artifact-graph CLI 与版本锁（FND-ADR-006）。</p>
 <h2 id="首版预算">首版预算<a class="headerlink" href="#首版预算" title="Permanent link">&para;</a></h2>
 <ul>
-<li>顶层 Contracts 对象：39 类（完整清单以 <code>packages/skill-family-contracts/src/registry.json</code> 为唯一真源）：project-manifest、profile-descriptor、project-profile（FND-ADR-013，1.7.0 纳入）、managed-file-lock、operation-request、operation-result、migration-manifest、adapter-source、report-model、report-binding、host-descriptor、host-registry、host-capability-fact、host-probe-result、adapter-build-manifest、host-operation-plan、host-operation-receipt、state-event-envelope、state-snapshot-metadata、token-estimate-result、surface-scan-policy、declared-read-surface-result、structured-scan-policy（FND-ADR-010/011）、timeout-policy、watchdog-termination-envelope（FND-ADR-012，append-only 保持 1.5.0）、public-boundary-declaration、platform-difference-registry、observation-scope、profile-adoption-declaration、audit-baseline-pin、token-estimate-record（审计规则裁决与整改 1.6.0 纳入）、source-authority-receipt（1.8.0 纳入）、filesystem-root-binding、fixed-set-publication-manifest、fixed-set-publication-receipt（1.9.0 纳入）、adapter-peer-verification-request、adapter-peer-verification-result（FND-ADR-018，1.10.0 纳入）、host-verification-request、host-verification-result（FND-ADR-019，1.11.0 纳入）；</li>
+<li>顶层 Contracts 对象：42 类（完整清单以 <code>packages/skill-family-contracts/src/registry.json</code> 为唯一真源）：project-manifest、profile-descriptor、project-profile（FND-ADR-013，1.7.0 纳入）、managed-file-lock、operation-request、operation-result、migration-manifest、adapter-source、report-model、report-binding、host-descriptor、host-registry、host-capability-fact、host-probe-result、adapter-build-manifest、host-operation-plan、host-operation-receipt、state-event-envelope、state-snapshot-metadata、token-estimate-result、surface-scan-policy、declared-read-surface-result、structured-scan-policy（FND-ADR-010/011）、timeout-policy、watchdog-termination-envelope（FND-ADR-012，append-only 保持 1.5.0）、public-boundary-declaration、platform-difference-registry、observation-scope、profile-adoption-declaration、audit-baseline-pin、token-estimate-record（审计规则裁决与整改 1.6.0 纳入）、source-authority-receipt（1.8.0 纳入）、filesystem-root-binding、fixed-set-publication-manifest、fixed-set-publication-receipt（1.9.0 纳入）、adapter-peer-verification-request、adapter-peer-verification-result（FND-ADR-018，1.10.0 纳入）、host-verification-request、host-verification-result（FND-ADR-019，1.11.0 纳入）、plugin-verification-request、plugin-verification-result、filesystem-tree-observation（FND-ADR-021，1.13.0 纳入）；</li>
 <li>Kit 顶层命令：4 个（scaffold、adopt-plan、projection、check）；</li>
 <li>强制机械规则：当前 9 条，预算不超过 20 条，绝对上限 30 条；CR-001 对登记表内全部 Schema 做统一编译；</li>
 <li>叶子包：3 个（skill-family-contracts、skill-family-harness-node、skill-family-engineering-kit）；</li>
 <li>Schema 校验器：Ajv 8.20.0（精确版本 pin），支持 draft-07 与 2020-12 双方言；</li>
-<li>kernel 协议：skill-family.kernel.operation（stable），Contracts 规格版本 1.12.0；Kernel 文档仍保持 1.8.0 生命周期坐标和字节基线；</li>
+<li>kernel 协议：skill-family.kernel.operation（stable），Contracts 规格版本 1.13.0；Kernel 文档仍保持 1.8.0 生命周期坐标和字节基线；</li>
 <li>默认运行时语言：Node；第二语言实现首版为 0。</li>
 </ul>
 <p>任何新增组件必须说明删除它会导致的两个以上真实消费者重复实现，并通过独立 fixture 验证。</p>

package/docs/en/architecture/index.html

@@ -2104,12 +2104,12 @@ Carries limited domain semantics? ──yes──▶ finite closed semantics: co
 <p>The three-package structure is preserved and a fourth package is not split out (FND-ADR-007); artifact governance uses the artifact-graph CLI and version-lock (FND-ADR-006).</p>
 <h2 id="First-Version-Budget">First-Version Budget<a class="headerlink" href="#First-Version-Budget" title="Permanent link">&para;</a></h2>
 <ul>
-<li>Top-level Contracts objects: 37 kinds, with <code>packages/skill-family-contracts/src/registry.json</code> as the sole source of truth;</li>
+<li>Top-level Contracts objects: 42 kinds, including the three 1.13.0 candidate objects <code>plugin-verification-request</code>, <code>plugin-verification-result</code>, and <code>filesystem-tree-observation</code>, with <code>packages/skill-family-contracts/src/registry.json</code> as the sole source of truth;</li>
 <li>Kit top-level commands: 4 (scaffold, adopt-plan, projection, check);</li>
 <li>Mandatory mechanical rules: currently 9, budget not exceeding 20, absolute ceiling 30; CR-001 uniformly compiles all Schemas within the registry;</li>
 <li>Leaf packages: 3 (skill-family-contracts, skill-family-harness-node, skill-family-engineering-kit);</li>
 <li>Schema validator: Ajv 8.20.0 (exact version pin), supporting both draft-07 and 2020-12 dialects;</li>
-<li>kernel protocol: skill-family.kernel.operation (stable), Contracts specification 1.10.0; the Kernel document remains at its 1.8.0 lifecycle coordinate and byte baseline;</li>
+<li>kernel protocol: skill-family.kernel.operation (stable), Contracts specification 1.13.0; the Kernel document remains at its 1.8.0 lifecycle coordinate and byte baseline;</li>
 <li>Default runtime language: Node; first-version implementations in a second language: 0.</li>
 </ul>
 <p>Any new component must justify the two-or-more real-consumer re-implementation that deleting it would cause, and be verified by an independent fixture.</p>