skill-family-engineering-kit 0.12.0 → 0.14.0

package/CHANGELOG.md

@@ -1,5 +1,41 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.14.0 locale=en baseline=sha256:ae68c432972367cf4f77239dcad446fe4d15fc73e6042f70bd0a7b67041f93b9 -->
+## [0.14.0] - 2026-08-28
+
+Engineering Kit 0.14.0 adds capability discovery, migration guidance, consumer contract-test wiring, and an explicit qualification entrypoint.
+
+### Added
+
+- Adds read-only capability assessment through adopt-plan and the list-capabilities CLI mode.
+- Adds consumer contract-test scaffolding guidance and the explicit qualification command for real-host evidence.
+
+### Changed
+
+- Documents separate candidate discovery, migration completion, contract integration, and real-host qualification conclusions.
+
+### Upgrade Notes
+
+Pin all three Foundation packages to 0.14.0. Capability assessment and migration planning write no files; contract vectors and official fakes prove wiring only; qualification remains an explicit consumer-owned activity.
+<!-- release-skill:changelog:end version=0.14.0 locale=en -->
+
+
+<!-- release-skill:changelog:start version=0.13.0 locale=en baseline=sha256:b9eed0b2361ff46c23ddd903b98b7059d9ceed8329f846010cb4a943101ec9a3 -->
+## [0.13.0] - 2026-08-26
+
+Engineering Kit 0.13.0 is a source candidate for complete plugin verification with separate installation, discovery and invocation facts.
+
+### Added
+
+- Adds the permanent candidate root entry runPluginVerification({ request, bindings, hostsRoot }).
+- Preserves complete plugin layouts and exposes installation observations without taking over caller acceptance policy.
+
+### Upgrade Notes
+
+Pin the three packages together. Existing runHostVerification and verifyHostVerificationBindings remain available for single-Skill verification. Every actual host/source combination still needs qualification; no publication or consumer mechanism removal is implied.
+<!-- release-skill:changelog:end version=0.13.0 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.12.0 locale=en baseline=sha256:6000579dc8b473dbeda1832274d971df0c4f3a62a90c973184dd70e59ffc8602 -->
 ## [0.12.0] - 2026-08-26
 

package/CHANGELOG.zh-CN.md

@@ -1,5 +1,41 @@
 # 变更日志
 
+<!-- release-skill:changelog:start version=0.14.0 locale=zh-CN baseline=sha256:c3c9e90c2c1e4c06d34871d18ba4062db46e484cbeccbf25867d8b59db32ccc0 -->
+## [0.14.0] - 2026-08-28
+
+Engineering Kit 0.14.0 增加能力发现、迁移指引、消费者契约测试接线和显式资格检查入口。
+
+### 新增
+
+- 通过 `adopt-plan` 与 `list-capabilities` CLI 模式增加只读能力评估。
+- 增加消费者契约测试脚手架指引，以及生成真实宿主证据的显式资格检查命令。
+
+### 变更
+
+- 明确区分候选发现、迁移完成、契约接入完成和真实宿主资格四种结论。
+
+### 升级说明
+
+三个 Foundation 包须一起精确锁定到 0.14.0。能力评估和迁移规划不写文件；契约向量与正式测试替身只证明接线；资格检查仍由消费者显式负责。
+<!-- release-skill:changelog:end version=0.14.0 locale=zh-CN -->
+
+
+<!-- release-skill:changelog:start version=0.13.0 locale=zh-CN baseline=sha256:3493c49151b2ebabddcba806d892ce967c0ae47621b0b2c75086e1cac334ebf9 -->
+## [0.13.0] - 2026-08-26
+
+Engineering Kit 0.13.0 源码候选增加完整插件验证，分别报告安装、发现和调用事实。
+
+### 新增
+
+- 新增永久候选根入口 runPluginVerification({ request, bindings, hostsRoot })。
+- 保留完整插件布局并提供安装观察，载荷接受政策仍由调用方决定。
+
+### 升级说明
+
+三个包须精确锁步。runHostVerification 与 verifyHostVerificationBindings 继续用于单 Skill 验证。每个真实宿主与来源组合仍须取得资格证据；本次不代表发布完成或消费者机制已退出。
+<!-- release-skill:changelog:end version=0.13.0 locale=zh-CN -->
+
+
 <!-- release-skill:changelog:start version=0.12.0 locale=zh-CN baseline=sha256:f2a68cdeac0b2a44d7a4cc64df8e8f371795b4150719d821a31866a6e8873e2f -->
 ## [0.12.0] - 2026-08-26
 

package/README.md

@@ -4,32 +4,27 @@
 
 # skill-family-engineering-kit
 
-<!-- release-skill:release-version: 0.12.0 -->
+<!-- release-skill:release-version: 0.14.0 -->
 
 An engineering toolkit used in development and CI. There are **exactly four** top-level commands, and no fifth:
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.12.0** (2026-08-26)
+**0.14.0** (2026-08-28)
 
-Engineering Kit 0.12.0 extends bounded real-host verification from two to five fixed built-in drivers.
+Engineering Kit 0.14.0 adds capability discovery, migration guidance, consumer contract-test wiring, and an explicit qualification entrypoint.
 
 **Added**
 
-- Extends runHostVerification with three fixed built-in drivers while retaining the Kimi and WorkBuddy raw-byte behavior.
+- Adds read-only capability assessment through adopt-plan and the list-capabilities CLI mode.
+- Adds consumer contract-test scaffolding guidance and the explicit qualification command for real-host evidence.
 
 **Changed**
 
-- Uses the classic plugin-root/skills/skill-id layout for the plugin-directory driver and validates complete JSONL event streams before accepting execution.
-- Keeps output meaning with consumers and applies strict text decoding only to the three new text-protocol drivers.
-- Registers Qoder as manual for host support and descriptor maturity, while its real-host verification capability remains candidate.
-
-**Fixed**
-
-- Rejects malformed protocol tails, invalid UTF-8 in text-protocol drivers, and version suffixes outside each driver's fixed format before they can support a successful public result.
+- Documents separate candidate discovery, migration completion, contract integration, and real-host qualification conclusions.
 
 **Upgrade Notes**
 
-Pin all three Foundation packages to 0.12.0. Existing runHostVerification and verifyHostVerificationBindings entrypoints and request identities remain unchanged. Reuse the host's existing login state; Foundation does not isolate authentication, freeze model identity, disable host tools, or decide domain PASS/FAIL. Qoder verification grants no build, plan, apply, install, update, uninstall, or rollback capability. The executable digest is a preflight observation and member snapshots cover only the declared members at the two observed times.
+Pin all three Foundation packages to 0.14.0. Capability assessment and migration planning write no files; contract vectors and official fakes prove wiring only; qualification remains an explicit consumer-owned activity.
 <!-- release-skill:managed:end id=latest-release -->
 
 | Command | Purpose | Side effects |
@@ -49,16 +44,59 @@ Kit is the "engineering stage" layer, depending on the Harness and Contracts. It
 
 ## Installation and Minimal Example
 
+Version 0.14.0 is a local candidate. Build all three tarballs into one temporary directory and install those exact files for a candidate check:
+
+```sh
+pack_dir="$(mktemp -d)"
+(cd packages/skill-family-contracts && pnpm pack --pack-destination "$pack_dir")
+(cd packages/skill-family-harness-node && pnpm pack --pack-destination "$pack_dir")
+(cd packages/skill-family-engineering-kit && pnpm pack --pack-destination "$pack_dir")
+mkdir "$pack_dir/consumer" && (cd "$pack_dir/consumer" && npm init -y)
+(cd "$pack_dir/consumer" && npm install "$pack_dir/skill-family-contracts-0.14.0.tgz" "$pack_dir/skill-family-harness-node-0.14.0.tgz" "$pack_dir/skill-family-engineering-kit-0.14.0.tgz")
+```
+
+After publication, use the registry coordinate:
+
+```sh
+npm install --save-dev skill-family-engineering-kit@0.14.0
+npm exec --package=skill-family-engineering-kit@0.14.0 -- skill-family-kit --help
+npm exec --package=skill-family-engineering-kit@0.14.0 -- skill-family-kit scaffold --root <empty-dir> --project-id my-project
+npm exec --package=skill-family-engineering-kit@0.14.0 -- skill-family-kit adopt-plan --root <repo> --list-capabilities --all --scope all --locale en --uses ./uses.json
+npm exec --package=skill-family-engineering-kit@0.14.0 -- skill-family-kit projection --root <repo>
+npm exec --package=skill-family-engineering-kit@0.14.0 -- skill-family-kit check --root <repo>
+```
+
+The four commands above cover skeleton generation, read-only inventory, managed projection, and diagnostics respectively; a zero-install form is available via `npm exec --package=skill-family-engineering-kit@0.14.0 -- skill-family-kit --help`.
+
+### Three adoption journeys
+
+New projects can evaluate all uses before choosing stable capabilities:
+
+```sh
+npm exec -- skill-family-kit adopt-plan --list-capabilities --all --scope all --locale en --uses ./uses.json
+npm exec -- skill-family-kit scaffold --root ./my-project --project-id my-project --capability <stable-id>
+```
+
+Existing projects start with a read-only plan, then record one decision for each declared use:
+
+```sh
+npm exec -- skill-family-kit adopt-plan --root ./existing-repo
+npm exec -- skill-family-kit adopt-plan --root ./existing-repo --list-capabilities --scope all --locale en
+```
+
+Daily work can query one requirement without knowing a capability ID:
+
 ```sh
-npm install --save-dev skill-family-engineering-kit@0.12.0
-npm exec -- skill-family-kit --help
-npm exec -- skill-family-kit scaffold --root <empty-dir> --project-id my-project
-npm exec -- skill-family-kit adopt-plan --root <repo>
-npm exec -- skill-family-kit projection --root <repo>
-npm exec -- skill-family-kit check --root <repo>
+npm exec -- skill-family-kit adopt-plan --list-capabilities --locale en --filter "must not leave a partial file when a write fails"
 ```
 
-The four commands above cover skeleton generation, read-only inventory, managed projection, and diagnostics respectively; a zero-install form is available via `npm exec --package=skill-family-engineering-kit@0.12.0 -- skill-family-kit --help`.
+The output distinguishes candidates (`supportedMatches`), boundaries (`boundary-found`), and no text match (`no-text-match`). A migration `complete` result covers only the migration gate. Contract integration is established by the consumer's adapter and domain tests. Real-host qualification is a separate explicit action:
+
+```sh
+npm exec -- skill-family-kit check qualification --root <consumer-repo> --capability foundation.kit.plugin-verification --request <request-json> --bindings <private-bindings-json> --native
+```
+
+The qualification command requires complete explicit inputs and can invoke the capability-specific host only after preflight; it does not turn candidate discovery or migration completion into a qualification claim.
 
 ### Public Profile SPI
 
@@ -238,3 +276,9 @@ This package must not perform git init, commit, push, tag, stash, branch switch,
 - Package-local source: `src/*.mjs`.
 - Package-local candidate source: `candidate/*`; canonical public imports: `skill-family-engineering-kit/quickstart-profile`, `/adoption`, and `/skill-naming`; historical migration alias: `skill-family-engineering-kit/candidate/quickstart-profile`.
 <!-- agent-quick-reference:end -->
+
+## Complete Plugin Candidate
+
+The candidate runPluginVerification({ request, bindings, hostsRoot }) preserves a complete plugin layout and separates installation, discovery and invocation facts. Each actual host/source combination still needs qualification evidence.
+
+Version 0.14.0 is a local source candidate and is not published. Consume the three locally verified tarballs; a version marker, unit test or successful install is not complete contract integration, migration completion, or real-host qualification.

package/README.zh-CN.md

@@ -5,32 +5,27 @@
 
 # skill-family-engineering-kit
 
-<!-- release-skill:release-version: 0.12.0 -->
+<!-- release-skill:release-version: 0.14.0 -->
 
 开发与 CI 阶段使用的工程工具包。**恰好四个**顶层命令，没有第五个：
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.12.0** (2026-08-26)
+**0.14.0** (2026-08-28)
 
-Engineering Kit 0.12.0 将受约束真实宿主验证从两个固定内置驱动扩展为五个。
+Engineering Kit 0.14.0 增加能力发现、迁移指引、消费者契约测试接线和显式资格检查入口。
 
 **新增**
 
-- 为 runHostVerification 增加三个固定的内置驱动，保留 Kimi 与 WorkBuddy 的原始字节行为。
+- 通过 `adopt-plan` 与 `list-capabilities` CLI 模式增加只读能力评估。
+- 增加消费者契约测试脚手架指引，以及生成真实宿主证据的显式资格检查命令。
 
 **变更**
 
-- 插件目录驱动使用 plugin-root/skills/skill-id 经典插件布局；JSONL 驱动必须扫描完整事件流后才接受执行结果。
-- 输出的业务含义由消费者判断，严格文本解码仅用于三个新增的文本协议驱动。
-- Qoder 的宿主支持和 Descriptor 成熟度登记为 manual，真实宿主验证能力继续标为 candidate。
-
-**修复**
-
-- 拒绝畸形协议尾部、文本协议中的非法 UTF-8，以及驱动固定格式之外的版本后缀，避免产生错误的公共成功结果。
+- 明确区分候选发现、迁移完成、契约接入完成和真实宿主资格四种结论。
 
 **升级说明**
 
-三个 Foundation 包须精确锁定到同一 0.12.0 版本。runHostVerification、verifyHostVerificationBindings 入口与请求身份不变。验证复用宿主现有登录态；Foundation 不隔离认证、不固定模型身份、不关闭宿主工具，也不判定领域 PASS/FAIL。Qoder 验证不授予 build、plan、apply、install、update、uninstall 或 rollback 能力。可执行文件摘要仅是启动前观察，成员快照仅覆盖已声明成员的两个观察时点。
+三个 Foundation 包须一起精确锁定到 0.14.0。能力评估和迁移规划不写文件；契约向量与正式测试替身只证明接线；资格检查仍由消费者显式负责。
 <!-- release-skill:managed:end id=latest-release -->
 
 | 命令 | 用途 | 副作用 |
@@ -50,16 +45,59 @@ Kit 是「工程阶段」层，依赖 Harness 与 Contracts。它只做四件事
 
 ## 安装和最小示例
 
+0.14.0 是本地候选版本。候选验证先把三个包分别打入同一个临时目录，再安装这三个精确 tarball：
+
+```sh
+pack_dir="$(mktemp -d)"
+(cd packages/skill-family-contracts && pnpm pack --pack-destination "$pack_dir")
+(cd packages/skill-family-harness-node && pnpm pack --pack-destination "$pack_dir")
+(cd packages/skill-family-engineering-kit && pnpm pack --pack-destination "$pack_dir")
+mkdir "$pack_dir/consumer" && (cd "$pack_dir/consumer" && npm init -y)
+(cd "$pack_dir/consumer" && npm install "$pack_dir/skill-family-contracts-0.14.0.tgz" "$pack_dir/skill-family-harness-node-0.14.0.tgz" "$pack_dir/skill-family-engineering-kit-0.14.0.tgz")
+```
+
+发布后再使用 registry 坐标：
+
+```sh
+npm install --save-dev skill-family-engineering-kit@0.14.0
+npm exec --package=skill-family-engineering-kit@0.14.0 -- skill-family-kit --help
+npm exec --package=skill-family-engineering-kit@0.14.0 -- skill-family-kit scaffold --root <empty-dir> --project-id my-project
+npm exec --package=skill-family-engineering-kit@0.14.0 -- skill-family-kit adopt-plan --root <repo> --list-capabilities --all --scope all --locale zh-CN --uses ./uses.json
+npm exec --package=skill-family-engineering-kit@0.14.0 -- skill-family-kit projection --root <repo>
+npm exec --package=skill-family-engineering-kit@0.14.0 -- skill-family-kit check --root <repo>
+```
+
+以上四条命令分别覆盖生成骨架、只读盘点、受管投影与诊断；零安装形式可用 `npm exec --package=skill-family-engineering-kit@0.14.0 -- skill-family-kit --help`。
+
+### 三条采用旅程
+
+新项目可以先评估全部用途，再选择稳定能力：
+
+```sh
+npm exec -- skill-family-kit adopt-plan --list-capabilities --all --scope all --locale zh-CN --uses ./uses.json
+npm exec -- skill-family-kit scaffold --root ./my-project --project-id my-project --capability <stable-id>
+```
+
+存量项目先运行只读计划，再为每个已声明用途记录一项 decision：
+
+```sh
+npm exec -- skill-family-kit adopt-plan --root ./existing-repo
+npm exec -- skill-family-kit adopt-plan --root ./existing-repo --list-capabilities --scope all --locale zh-CN
+```
+
+日常工作不必先知道 capability ID，可以直接查询单项需求：
+
+```sh
+npm exec -- skill-family-kit adopt-plan --list-capabilities --locale zh-CN --filter "写文件失败时不能留下残缺文件"
+```
+
+输出会区分候选（`supportedMatches`）、边界（`boundary-found`）和无文本命中（`no-text-match`）。迁移 `complete` 只覆盖迁移门禁；契约接入完成由消费者的适配器和领域测试证明。真实宿主资格是独立的显式动作：
+
 ```sh
-npm install --save-dev skill-family-engineering-kit@0.12.0
-npm exec -- skill-family-kit --help
-npm exec -- skill-family-kit scaffold --root <empty-dir> --project-id my-project
-npm exec -- skill-family-kit adopt-plan --root <repo>
-npm exec -- skill-family-kit projection --root <repo>
-npm exec -- skill-family-kit check --root <repo>
+npm exec -- skill-family-kit check qualification --root <consumer-repo> --capability foundation.kit.plugin-verification --request <request-json> --bindings <private-bindings-json> --native
 ```
 
-以上四条命令分别覆盖生成骨架、只读盘点、受管投影与诊断；零安装形式可用 `npm exec --package=skill-family-engineering-kit@0.12.0 -- skill-family-kit --help`。
+资格命令要求完整的显式输入，预检通过后才可能调用能力特定宿主；候选发现或迁移完成不会自动变成资格结论。
 
 ### 公共 Profile SPI
 
@@ -123,14 +161,6 @@ Profile 必须显式提供，Kit 不默认绑定具体宿主。规范宿主 ID
 
 `executableSha256` 只绑定启动前严格读取的字节，进程仍按路径启动；调用方须在版本观察和执行期间独占可执行文件命名空间。Foundation 保留 `session-*` 目录，调用方检查后清理独占的外层 `temporaryRoot`。
 
-### 候选真实宿主验证库 API
-
-`runHostVerification({ request, bindings, hostsRoot })` 和 `verifyHostVerificationBindings({ results, expectedCommon, expectedRequestDigestByHost })` 是库 API，不是第五个 Kit 命令。前者通过已准入的内置 driver（`kimi-code-print-v1` 或 `workbuddy-codebuddy-print-v1`，均绑定 `existing-user-state + host-managed`），针对调用方绑定的根执行一次候选验证，并返回经过 Contracts 校验的脱敏四态结果；后者是纯函数，只组合 `observed` 结果，并核对共同字段和逐宿主 request digest。
-
-该 API 不接管消费者 workload、领域输出检查、领域 PASS/FAIL、发布新鲜度或发布状态。调用方提供 canonical 的 `existingUserStateRoot`；Foundation 只把它投影进子进程环境，不读取、摘要、修改或清理其中内容，也不会因此为 manual Profile 授予 build、plan、apply、install、update 或 uninstall 能力。
-
-`executableSha256` 只绑定启动前严格读取到的字节。实际进程仍按 pathname 启动，因此调用方必须在 probe 和正式调用期间独占可执行文件的命名空间。Foundation 保留本次调用的 `session-*` 目录，不按路径删除；调用方检查完成后，统一清理其独占的外层 `temporaryRoot`。
-
 ## 典型使用场景
 
 - 新项目骨架：`scaffold`（不覆盖非空存量仓）。
@@ -247,3 +277,9 @@ projection 只写同时满足两个条件的路径：manifest 列出，且目标
 - 包内源：`src/*.mjs`。
 - 包内 Candidate 源：`candidate/*`；规范公共导入：`skill-family-engineering-kit/quickstart-profile`、`/adoption` 与 `/skill-naming`；历史迁移别名：`skill-family-engineering-kit/candidate/quickstart-profile`。
 <!-- agent-quick-reference:end -->
+
+## 完整插件候选能力
+
+新增候选 runPluginVerification({ request, bindings, hostsRoot })，保留完整插件布局并分别报告安装、发现与调用事实。真实宿主与来源组合仍需独立资格证据。
+
+0.14.0 为本地源码候选，尚未发布。消费本地已验证的三包 tarball；版本标记、单元测试或安装成功都不等于契约接入完成、迁移完成或真实宿主资格。

package/SECURITY.md

@@ -4,10 +4,10 @@
 
 | 版本 | 安全支持状态 |
 | --- | --- |
-| 0.1.x | 当前维护线：接受安全报告 |
+| 0.13.x | 当前维护线：接受安全报告 |
 | 0.0.0 | 未发布的内部骨架版本，不在公开支持范围 |
 
-安全修复只承诺在最新的 0.1.x 线上提供；更早版本不回移修复。
+安全修复只承诺在最新的 0.13.x 线上提供；更早版本不回移修复。
 
 ## 报告漏洞