skill-family-engineering-kit 0.19.2 → 0.20.0

package/CHANGELOG.md

@@ -1,5 +1,40 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.20.0 locale=en baseline=sha256:4ea3064e77b2e33e76d1476f02f7d22920638e872cb87c098e8260f617081313 -->
+## [0.20.0] - 2026-09-10
+
+Engineering Kit 0.20.0 adds Cursor project Skill projection and a fixed Cursor Agent verification driver on the existing host-verification path.
+
+### Added
+
+- Registers `.cursor/skills` as the Cursor project Skill root while preserving manual lifecycle planning.
+- Adds `cursor-agent-print-v1` with fixed workspace, ask-mode, sandbox, JSON output, version, and failure checks.
+
+### Changed
+
+- Qualifies project-level Skill discovery through Cursor CLI menu discovery and one explicit invocation, without requiring a duplicate IDE check.
+
+### Upgrade Notes
+
+Pin all three Foundation packages to exactly 0.20.0 and rebuild official Bundles. Cursor stays manual/developer-preview; the driver does not add automatic trust, model selection, or Marketplace lifecycle management.
+<!-- release-skill:changelog:end version=0.20.0 locale=en -->
+
+
+<!-- release-skill:changelog:start version=0.19.3 locale=en baseline=sha256:a75e6ad165b31be8764c3f7e1b8048120f431d5da29e7bfdff5e4338d8fa896a -->
+## [0.19.3] - 2026-09-08
+
+Engineering Kit 0.19.3 aligns its package, release documentation, and generated projections with the Foundation Adoption Review Qoder distribution patch. Public commands and behavior are unchanged.
+
+### Changed
+
+- Aligns the package version, release documentation, and verified public package projection with Foundation 0.19.3 without adding a command, capability, or adapter path.
+
+### Upgrade Notes
+
+Pin all three Foundation packages to exactly 0.19.3 and rebuild official Bundles under the existing source-identity and integrity rules. The capability catalog, host descriptors, drivers, since values, and maturity are unchanged.
+<!-- release-skill:changelog:end version=0.19.3 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.19.2 locale=en baseline=sha256:b4a9f795a1264bc28c9d37378a1d92eb4fd8c1e023506fbe6f5752b08842e2f0 -->
 ## [0.19.2] - 2026-09-08
 

package/CHANGELOG.zh-CN.md

@@ -1,5 +1,40 @@
 # 变更日志
 
+<!-- release-skill:changelog:start version=0.20.0 locale=zh-CN baseline=sha256:7f7e7f2175429d96720b04bb378afcb796e01f642abc0cdd7114fddf4a808b62 -->
+## [0.20.0] - 2026-09-10
+
+Engineering Kit 0.20.0 在既有宿主验证路径上增加 Cursor 项目级 Skill 投影和固定 Cursor Agent 验证驱动。
+
+### 新增
+
+- 登记 `.cursor/skills` 作为 Cursor 项目级 Skill 根，生命周期计划继续保持手动。
+- 增加 `cursor-agent-print-v1`，固定工作区、问答模式、沙箱、JSON 输出、版本与失败检查。
+
+### 变更
+
+- 通过 Cursor CLI 菜单发现和一次显式调用取得项目级 Skill 发现资格，不重复执行 IDE 图形界面检查。
+
+### 升级说明
+
+三个 Foundation 包须一起精确锁定到 0.20.0，并重建官方 Bundle。Cursor 继续保持 manual/developer-preview；驱动不增加自动信任、模型选择或 Marketplace 生命周期管理。
+<!-- release-skill:changelog:end version=0.20.0 locale=zh-CN -->
+
+
+<!-- release-skill:changelog:start version=0.19.3 locale=zh-CN baseline=sha256:16f48a8354216cfe0f1354bed02f0a5cee6ef0b9adaaad3339dc9f80c1070e2b -->
+## [0.19.3] - 2026-09-08
+
+Engineering Kit 0.19.3 将包版本、发布文档和生成投影与 Foundation Adoption Review 的 Qoder 分发补丁对齐。公开命令和行为保持不变。
+
+### 变更
+
+- 包版本、发布文档和经验证的公开 package.json 投影与 Foundation 0.19.3 数值对齐，不增加命令、能力或 adapter 路径。
+
+### 升级说明
+
+三个 Foundation 包须一起精确锁定到 0.19.3，并按既有来源身份与完整性规则重建官方 Bundle。能力目录、宿主 descriptor、driver、since 字段和成熟度均不变。
+<!-- release-skill:changelog:end version=0.19.3 locale=zh-CN -->
+
+
 <!-- release-skill:changelog:start version=0.19.2 locale=zh-CN baseline=sha256:bd0cbfd935e7b9751f6311f3d1114df2db5066448d1830f27b7c92aa3aca9687 -->
 ## [0.19.2] - 2026-09-08
 

package/README.md

@@ -4,22 +4,27 @@
 
 # skill-family-engineering-kit
 
-<!-- release-skill:release-version: 0.19.2 -->
+<!-- release-skill:release-version: 0.20.0 -->
 
 An engineering toolkit used in development and CI. There are **exactly four** top-level commands, and no fifth:
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.19.2** (2026-09-08)
+**0.20.0** (2026-09-10)
 
-Engineering Kit 0.19.2 aligns its package version and generated projections with the Foundation Adoption Review distribution patch. Public commands and behavior are unchanged.
+Engineering Kit 0.20.0 adds Cursor project Skill projection and a fixed Cursor Agent verification driver on the existing host-verification path.
+
+**Added**
+
+- Registers `.cursor/skills` as the Cursor project Skill root while preserving manual lifecycle planning.
+- Adds `cursor-agent-print-v1` with fixed workspace, ask-mode, sandbox, JSON output, version, and failure checks.
 
 **Changed**
 
-- Aligns the package version, release documentation, and necessary generated projections with Foundation 0.19.2 without adding a command, capability, or adapter path.
+- Qualifies project-level Skill discovery through Cursor CLI menu discovery and one explicit invocation, without requiring a duplicate IDE check.
 
 **Upgrade Notes**
 
-Pin all three Foundation packages to exactly 0.19.2 and rebuild official Bundles under the existing source-identity and integrity rules. The capability catalog, host descriptors, drivers, since values, and maturity are unchanged.
+Pin all three Foundation packages to exactly 0.20.0 and rebuild official Bundles. Cursor stays manual/developer-preview; the driver does not add automatic trust, model selection, or Marketplace lifecycle management.
 <!-- release-skill:managed:end id=latest-release -->
 
 ### Foundation 0.15.0 candidate qualification entries
@@ -49,7 +54,7 @@ Kit is the "engineering stage" layer, depending on the Harness and Contracts. It
 
 ## Installation and Minimal Example
 
-Version 0.19.2 is the local source candidate. Build all three tarballs into one temporary directory and install those exact files for a candidate check:
+Version 0.20.0 is the local source candidate. Build all three tarballs into one temporary directory and install those exact files for a candidate check:
 
 ```sh
 pack_dir="$(mktemp -d)"
@@ -57,21 +62,21 @@ pack_dir="$(mktemp -d)"
 (cd packages/skill-family-harness-node && pnpm pack --pack-destination "$pack_dir")
 (cd packages/skill-family-engineering-kit && pnpm pack --pack-destination "$pack_dir")
 mkdir "$pack_dir/consumer" && (cd "$pack_dir/consumer" && npm init -y)
-(cd "$pack_dir/consumer" && npm install "$pack_dir/skill-family-contracts-0.19.2.tgz" "$pack_dir/skill-family-harness-node-0.19.2.tgz" "$pack_dir/skill-family-engineering-kit-0.19.2.tgz")
+(cd "$pack_dir/consumer" && npm install "$pack_dir/skill-family-contracts-0.20.0.tgz" "$pack_dir/skill-family-harness-node-0.20.0.tgz" "$pack_dir/skill-family-engineering-kit-0.20.0.tgz")
 ```
 
 After publication, use the registry coordinate:
 
 ```sh
-npm install --save-dev skill-family-engineering-kit@0.19.2
-npm exec --package=skill-family-engineering-kit@0.19.2 -- skill-family-kit --help
-npm exec --package=skill-family-engineering-kit@0.19.2 -- skill-family-kit scaffold --root <empty-dir> --project-id my-project
-npm exec --package=skill-family-engineering-kit@0.19.2 -- skill-family-kit adopt-plan --root <repo> --list-capabilities --all --scope all --locale en --uses ./uses.json
-npm exec --package=skill-family-engineering-kit@0.19.2 -- skill-family-kit projection --root <repo>
-npm exec --package=skill-family-engineering-kit@0.19.2 -- skill-family-kit check --root <repo>
+npm install --save-dev skill-family-engineering-kit@0.20.0
+npm exec --package=skill-family-engineering-kit@0.20.0 -- skill-family-kit --help
+npm exec --package=skill-family-engineering-kit@0.20.0 -- skill-family-kit scaffold --root <empty-dir> --project-id my-project
+npm exec --package=skill-family-engineering-kit@0.20.0 -- skill-family-kit adopt-plan --root <repo> --list-capabilities --all --scope all --locale en --uses ./uses.json
+npm exec --package=skill-family-engineering-kit@0.20.0 -- skill-family-kit projection --root <repo>
+npm exec --package=skill-family-engineering-kit@0.20.0 -- skill-family-kit check --root <repo>
 ```
 
-The four commands above cover skeleton generation, read-only inventory, managed projection, and diagnostics respectively; a zero-install form is available via `npm exec --package=skill-family-engineering-kit@0.19.2 -- skill-family-kit --help`.
+The four commands above cover skeleton generation, read-only inventory, managed projection, and diagnostics respectively; a zero-install form is available via `npm exec --package=skill-family-engineering-kit@0.20.0 -- skill-family-kit --help`.
 
 ### Three adoption journeys
 
@@ -290,4 +295,4 @@ The candidate `runPluginVerification({ request, bindings, hostsRoot })` preserve
 
 The separate `runSkillFamilyDirectoryVerification({ request, bindings })` entry fixes the Kimi production argv and narrow environment and rejects caller observation. Its raw parser is exercised through the production process path, but no controlled fixture event is promoted to `observed`; without an official typed mapping, the public result remains `indeterminate` and a manual candidate.
 
-Version 0.19.2 is the local source candidate. Remote availability must be established by the corresponding release-skill post-release evidence. Consume the three locally verified tarballs for candidate checks; a version marker, unit test, or successful install is not complete contract integration, migration completion, or real-host qualification.
+Version 0.20.0 is the local source candidate. Remote availability must be established by the corresponding release-skill post-release evidence. Consume the three locally verified tarballs for candidate checks; a version marker, unit test, or successful install is not complete contract integration, migration completion, or real-host qualification.

package/README.zh-CN.md

@@ -5,22 +5,27 @@
 
 # skill-family-engineering-kit
 
-<!-- release-skill:release-version: 0.19.2 -->
+<!-- release-skill:release-version: 0.20.0 -->
 
 开发与 CI 阶段使用的工程工具包。**恰好四个**顶层命令，没有第五个：
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.19.2** (2026-09-08)
+**0.20.0** (2026-09-10)
 
-Engineering Kit 0.19.2 将包版本和生成投影与 Foundation Adoption Review 分发补丁对齐。公开命令和行为保持不变。
+Engineering Kit 0.20.0 在既有宿主验证路径上增加 Cursor 项目级 Skill 投影和固定 Cursor Agent 验证驱动。
+
+**新增**
+
+- 登记 `.cursor/skills` 作为 Cursor 项目级 Skill 根，生命周期计划继续保持手动。
+- 增加 `cursor-agent-print-v1`，固定工作区、问答模式、沙箱、JSON 输出、版本与失败检查。
 
 **变更**
 
-- 包版本、发布说明和必要生成投影与 Foundation 0.19.2 数值对齐，不增加命令、能力或 adapter 路径。
+- 通过 Cursor CLI 菜单发现和一次显式调用取得项目级 Skill 发现资格，不重复执行 IDE 图形界面检查。
 
 **升级说明**
 
-三个 Foundation 包须一起精确锁定到 0.19.2，并按既有来源身份与完整性规则重建官方 Bundle。能力目录、宿主 descriptor、driver、since 字段和成熟度均不变。
+三个 Foundation 包须一起精确锁定到 0.20.0，并重建官方 Bundle。Cursor 继续保持 manual/developer-preview；驱动不增加自动信任、模型选择或 Marketplace 生命周期管理。
 <!-- release-skill:managed:end id=latest-release -->
 
 ### Foundation 0.15.0 candidate 资格入口
@@ -50,7 +55,7 @@ Kit 是「工程阶段」层，依赖 Harness 与 Contracts。它只做四件事
 
 ## 安装和最小示例
 
-0.19.2 是本地源码候选。候选验证先把三个包分别打入同一个临时目录，再安装这三个精确 tarball：
+0.20.0 是本地源码候选。候选验证先把三个包分别打入同一个临时目录，再安装这三个精确 tarball：
 
 ```sh
 pack_dir="$(mktemp -d)"
@@ -58,21 +63,21 @@ pack_dir="$(mktemp -d)"
 (cd packages/skill-family-harness-node && pnpm pack --pack-destination "$pack_dir")
 (cd packages/skill-family-engineering-kit && pnpm pack --pack-destination "$pack_dir")
 mkdir "$pack_dir/consumer" && (cd "$pack_dir/consumer" && npm init -y)
-(cd "$pack_dir/consumer" && npm install "$pack_dir/skill-family-contracts-0.19.2.tgz" "$pack_dir/skill-family-harness-node-0.19.2.tgz" "$pack_dir/skill-family-engineering-kit-0.19.2.tgz")
+(cd "$pack_dir/consumer" && npm install "$pack_dir/skill-family-contracts-0.20.0.tgz" "$pack_dir/skill-family-harness-node-0.20.0.tgz" "$pack_dir/skill-family-engineering-kit-0.20.0.tgz")
 ```
 
 发布后再使用 registry 坐标：
 
 ```sh
-npm install --save-dev skill-family-engineering-kit@0.19.2
-npm exec --package=skill-family-engineering-kit@0.19.2 -- skill-family-kit --help
-npm exec --package=skill-family-engineering-kit@0.19.2 -- skill-family-kit scaffold --root <empty-dir> --project-id my-project
-npm exec --package=skill-family-engineering-kit@0.19.2 -- skill-family-kit adopt-plan --root <repo> --list-capabilities --all --scope all --locale zh-CN --uses ./uses.json
-npm exec --package=skill-family-engineering-kit@0.19.2 -- skill-family-kit projection --root <repo>
-npm exec --package=skill-family-engineering-kit@0.19.2 -- skill-family-kit check --root <repo>
+npm install --save-dev skill-family-engineering-kit@0.20.0
+npm exec --package=skill-family-engineering-kit@0.20.0 -- skill-family-kit --help
+npm exec --package=skill-family-engineering-kit@0.20.0 -- skill-family-kit scaffold --root <empty-dir> --project-id my-project
+npm exec --package=skill-family-engineering-kit@0.20.0 -- skill-family-kit adopt-plan --root <repo> --list-capabilities --all --scope all --locale zh-CN --uses ./uses.json
+npm exec --package=skill-family-engineering-kit@0.20.0 -- skill-family-kit projection --root <repo>
+npm exec --package=skill-family-engineering-kit@0.20.0 -- skill-family-kit check --root <repo>
 ```
 
-以上四条命令分别覆盖生成骨架、只读盘点、受管投影与诊断；零安装形式可用 `npm exec --package=skill-family-engineering-kit@0.19.2 -- skill-family-kit --help`。
+以上四条命令分别覆盖生成骨架、只读盘点、受管投影与诊断；零安装形式可用 `npm exec --package=skill-family-engineering-kit@0.20.0 -- skill-family-kit --help`。
 
 ### 三条采用旅程
 
@@ -291,4 +296,4 @@ Foundation 本身不发起网络请求，但绑定的 executable 仍可能联网
 
 独立入口 `runSkillFamilyDirectoryVerification({ request, bindings })` 固定 Kimi 生产 argv 与窄环境，并拒绝调用方 observation。原始 parser 通过生产进程路径验证，但受控 fixture 事件不会被提升为 `observed`；缺少官方 typed mapping 时，公共结果保持 `indeterminate` 和 manual candidate。
 
-0.19.2 是本地源码候选，远端可用性须由对应的 release-skill 发布后证据证明。候选检查使用本地已验证的三包 tarball；版本标记、单元测试或安装成功都不等于契约接入完成、迁移完成或真实宿主资格。
+0.20.0 是本地源码候选，远端可用性须由对应的 release-skill 发布后证据证明。候选检查使用本地已验证的三包 tarball；版本标记、单元测试或安装成功都不等于契约接入完成、迁移完成或真实宿主资格。

package/data/hosts/cursor/host-descriptor.json

@@ -0,0 +1,34 @@
+{
+  "schemaVersion": 1,
+  "kind": "skill-family.host-descriptor",
+  "hostId": "cursor",
+  "displayName": "Cursor",
+  "support": "manual",
+  "maturity": "developer-preview",
+  "sourceAliases": [],
+  "verification": {
+    "driverId": "cursor-agent-print-v1",
+    "authStrategy": "existing-user-state",
+    "credentialMutation": "host-managed"
+  },
+  "pathCategories": [
+    {
+      "id": "cursor-project-skills",
+      "role": "skill-root",
+      "scope": "project",
+      "anchor": "project-root",
+      "relPath": ".cursor/skills"
+    }
+  ],
+  "probeCapabilities": [
+    "cli",
+    "version",
+    "payload",
+    "registry",
+    "discover",
+    "enabled",
+    "reload",
+    "smoke",
+    "uninstall"
+  ]
+}

package/data/hosts/registry.json

@@ -4,6 +4,7 @@
   "hosts": [
     "claude",
     "codex",
+    "cursor",
     "kimi-code",
     "workbuddy",
     "codebuddy",

package/docs/en/quickstart/index.html

@@ -1894,15 +1894,16 @@
 <h1 id="Quickstart">Quickstart<a class="headerlink" href="#Quickstart" title="Permanent link">&para;</a></h1>
 <p>This page gives ordinary developers three executable journeys: discovering capabilities and generating a new project, adopting an existing project, and querying one requirement during daily work. Each journey includes exact commands; architecture routing and API details live in the linked references.</p>
 <h2 id="Shared-Installation-Prerequisite">Shared Installation Prerequisite<a class="headerlink" href="#Shared-Installation-Prerequisite" title="Permanent link">&para;</a></h2>
-<p>For local candidate validation, build the three <code>0.14.0</code> tarballs from the Foundation workspace and install them into a temporary consumer. Run these commands from the Foundation workspace root:</p>
-<pre><code class="language-sh">pack_dir=&quot;$(mktemp -d)&quot;
+<p>For local candidate validation, build the three current-version tarballs from the Foundation workspace and install them into a temporary consumer. Run these commands from the Foundation workspace root; <code>foundation_version</code> reads the root <code>package.json</code> and supplies the version for all three tarballs:</p>
+<pre><code class="language-sh">foundation_version=&quot;$(node -p &quot;require('./package.json').version&quot;)&quot;
+pack_dir=&quot;$(mktemp -d)&quot;
 (cd packages/skill-family-contracts &amp;&amp; pnpm pack --pack-destination &quot;$pack_dir&quot;)
 (cd packages/skill-family-harness-node &amp;&amp; pnpm pack --pack-destination &quot;$pack_dir&quot;)
 (cd packages/skill-family-engineering-kit &amp;&amp; pnpm pack --pack-destination &quot;$pack_dir&quot;)
 mkdir &quot;$pack_dir/consumer&quot; &amp;&amp; (cd &quot;$pack_dir/consumer&quot; &amp;&amp; npm init -y)
-(cd &quot;$pack_dir/consumer&quot; &amp;&amp; npm install &quot;$pack_dir/skill-family-contracts-0.14.0.tgz&quot; &quot;$pack_dir/skill-family-harness-node-0.14.0.tgz&quot; &quot;$pack_dir/skill-family-engineering-kit-0.14.0.tgz&quot;)
+(cd &quot;$pack_dir/consumer&quot; &amp;&amp; npm install &quot;$pack_dir/skill-family-contracts-${foundation_version}.tgz&quot; &quot;$pack_dir/skill-family-harness-node-${foundation_version}.tgz&quot; &quot;$pack_dir/skill-family-engineering-kit-${foundation_version}.tgz&quot;)
 </code></pre>
-<p>After publication, install the exact coordinate <code>skill-family-engineering-kit@0.14.0</code>, then run the <code>npm exec</code> commands below.</p>
+<p>After publication, install the exact coordinates listed on the Current Product Status page, then run the <code>npm exec</code> commands below.</p>
 <h2 id="New-Project-Discover-Capabilities-and-Generate-a-Skeleton">New Project: Discover Capabilities and Generate a Skeleton<a class="headerlink" href="#New-Project-Discover-Capabilities-and-Generate-a-Skeleton" title="Permanent link">&para;</a></h2>
 <p>Start by evaluating the project's uses, then select stable capabilities explicitly. <code>--list-capabilities</code> is read-only; the <code>--uses</code> file should contain problems, constraints, retained guarantees, and optional filters, never credentials or private business data.</p>
 <pre><code class="language-sh">npm exec -- skill-family-kit adopt-plan --list-capabilities --all --scope all --locale en --uses ./uses.json

package/docs/integration/audit/version-compatibility/index.html

@@ -1791,7 +1791,7 @@
 <tbody>
 <tr>
 <td><code>contractsVersion</code></td>
-<td>Contracts 冻结版本（当前 <code>1.15.0</code>）</td>
+<td>Contracts 源码候选版本（当前 <code>1.18.0</code>）</td>
 <td>机器契约内容的版本</td>
 </tr>
 <tr>
@@ -1806,7 +1806,7 @@
 </tr>
 </tbody>
 </table>
-<p>三者都由 <code>describeAuditSurface()</code> 一次性给出，审计侧把它们与当前 Contracts 版本对应的基线 pin 比对（当前为 <code>baseline/contracts-1.15.0.pin.json</code>）。</p>
+<p>三者都由 <code>describeAuditSurface()</code> 一次性给出，审计侧把它们与当前 Contracts 版本对应的基线 pin 比对（当前源码候选为 <code>baseline/contracts-1.18.0.pin.json</code>；最近已发布规格的 <code>contracts-1.17.0.pin.json</code> 保持只读）。</p>
 <h2 id="兼容规则">兼容规则<a class="headerlink" href="#兼容规则" title="Permanent link">&para;</a></h2>
 <p>一个被消费的 Contracts 包与某个基线 pin <strong>兼容</strong>，当且仅当同时满足：</p>
 <ol>
@@ -1872,7 +1872,10 @@
 <li><strong>Contracts 1.12.0（2026-08-26）</strong>：扩展既有 <code>host-descriptor</code> 的固定宿主验证组合，并允许 <code>host-verification-result</code> 在退出码为零但输出协议不合法时表达执行失败。顶层对象仍为 39 类，无新增 Schema ID 或错误码。registry、rules、error-codes 更新版本坐标，Kernel 保持 1.8.0 字节基线。新 pin 只由 <code>scripts/baseline-pin-gen.mjs --update</code> 从公开表面生成并自校验；1.11.0 及更早 pin 不改写。</li>
 <li><strong>Contracts 1.13.0（2026-08-26）</strong>：增加 <code>plugin-verification-request</code>、<code>plugin-verification-result</code> 和 <code>filesystem-tree-observation</code> 三个候选顶层契约，顶层对象由 39 类增至 42 类；同时为 watchdog 信封增加可选的每流输出限额事实，未启用限额的旧调用保持原形状。<code>contracts-1.13.0.pin.json</code> 由公开表面机械生成并保留为历史只读兼容存档。</li>
 <li><strong>Contracts 1.14.0（2026-08-28）</strong>：增加消费者契约测试向量与能力采用字段，明确区分候选发现、迁移完成、契约接入完成和真实宿主资格；消费者向量仍是候选测试合同，不改变既有宿主验证身份。<code>contracts-1.14.0.pin.json</code> 保留为历史只读兼容存档。</li>
-<li><strong>Contracts 1.15.0（2026-08-29）</strong>：增加 <code>executable-identity-observation</code>、<code>skill-family-directory-verification-request</code> 和 <code>skill-family-directory-verification-result</code> 三个候选顶层契约，并将 Kimi <code>driverVersion=1.0.0</code> 与闭合 <code>cliVersion=0.39.1</code> 分开。顶层对象由 42 类增至 45 类；Kernel 仍为 1.8.0，审计消费面仍为 <code>auditSurfaceVersion=1</code>。当前 pin 为 <code>baseline/contracts-1.15.0.pin.json</code>，其 <code>supersedes</code> 指向不可变的 <code>contracts-1.14.0.pin.json</code>；更早 pin 均继续作为只读兼容存档。</li>
+<li><strong>Contracts 1.15.0（2026-08-29）</strong>：增加 <code>executable-identity-observation</code>、<code>skill-family-directory-verification-request</code> 和 <code>skill-family-directory-verification-result</code> 三个候选顶层契约，并将 Kimi <code>driverVersion=1.0.0</code> 与闭合 <code>cliVersion=0.39.1</code> 分开。顶层对象由 42 类增至 45 类；Kernel 仍为 1.8.0，审计消费面仍为 <code>auditSurfaceVersion=1</code>。<code>contracts-1.15.0.pin.json</code> 的 <code>supersedes</code> 指向不可变的 <code>contracts-1.14.0.pin.json</code>；更早 pin 均继续作为只读兼容存档。</li>
+<li><strong>Contracts 1.16.0（2026-09-07）</strong>：新增 <code>engineering-baseline</code> 顶层契约，顶层对象由 45 类增至 46 类；它只登记中立身份、规则谱系引用与 Foundation 参考骨架身份，不把 Audit 规则正文或发布状态复制进 Contracts。<code>contracts-1.16.0.pin.json</code> 保持历史只读。</li>
+<li><strong>Contracts 1.17.0（2026-09-07）</strong>：为有界机制批量候选重记版本承载文档，稳定顶层对象仍为 46 类，批量合同保持 candidate-only，不进入稳定登记表。<code>contracts-1.17.0.pin.json</code> 是最近已发布规格的只读基线。</li>
+<li><strong>Contracts 1.18.0（2026-09-10，未发布候选）</strong>：扩展稳定 <code>host-descriptor</code> 的封闭验证组合，允许 <code>cursor</code> 与 <code>cursor-agent-print-v1</code> 的唯一配对；顶层对象、错误码、规则、Kernel 协议和 <code>auditSurfaceVersion</code> 不变。<code>contracts-1.18.0.pin.json</code> 从公开 Contracts 表面机械生成并指向不可变的 1.17.0 pin；Cursor CLI 的 <code>/</code> 菜单发现与显式调用已通过，Foundation npm 包版本仍由发布计划单独递增。</li>
 <li>审计运行时先做包锁验证（见 isolation-and-lockfile.md），再做变异重放；pin 不匹配时，变异重放结果不得被采信。</li>
 </ul>
 <h2 id="profile-行为变更纪律2026-08-19D6">profile 行为变更纪律（2026-08-19，D6）<a class="headerlink" href="#profile-行为变更纪律2026-08-19D6" title="Permanent link">&para;</a></h2>

package/docs/public/status/index.html

@@ -1792,17 +1792,17 @@
 <tbody>
 <tr>
 <td><code>skill-family-contracts</code></td>
-<td>0.19.2</td>
+<td>0.20.0</td>
 <td><a href="https://github.com/ifoohoo/skill-family-contracts">ifoohoo/skill-family-contracts</a></td>
 </tr>
 <tr>
 <td><code>skill-family-harness-node</code></td>
-<td>0.19.2</td>
+<td>0.20.0</td>
 <td><a href="https://github.com/ifoohoo/skill-family-harness-node">ifoohoo/skill-family-harness-node</a></td>
 </tr>
 <tr>
 <td><code>skill-family-engineering-kit</code></td>
-<td>0.19.2</td>
+<td>0.20.0</td>
 <td><a href="https://github.com/ifoohoo/skill-family-engineering-kit">ifoohoo/skill-family-engineering-kit</a></td>
 </tr>
 </tbody>

package/docs/quickstart/index.html

@@ -1894,13 +1894,14 @@
 <h1 id="快速开始">快速开始<a class="headerlink" href="#快速开始" title="Permanent link">&para;</a></h1>
 <p>本页给普通开发者三条可执行旅程：新项目能力发现与骨架生成、存量项目采用与迁移、日常单需求查询。每条路径都给出精确命令；架构路由与 API 细节转到对应文档。</p>
 <h2 id="公共安装前提">公共安装前提<a class="headerlink" href="#公共安装前提" title="Permanent link">&para;</a></h2>
-<p>本地候选验证从工作区打出三份当前版本 tarball，并把它们安装到临时 consumer；当前版本见唯一状态页 <code>docs/status/current.md</code>。以下命令从 Foundation 工作区根目录运行：</p>
-<pre><code class="language-sh">pack_dir=&quot;$(mktemp -d)&quot;
+<p>本地候选验证从工作区打出三份当前版本 tarball，并把它们安装到临时 consumer。以下命令从 Foundation 工作区根目录运行；<code>foundation_version</code> 会读取根 <code>package.json</code>，作为三份 tarball 共用的版本：</p>
+<pre><code class="language-sh">foundation_version=&quot;$(node -p &quot;require('./package.json').version&quot;)&quot;
+pack_dir=&quot;$(mktemp -d)&quot;
 (cd packages/skill-family-contracts &amp;&amp; pnpm pack --pack-destination &quot;$pack_dir&quot;)
 (cd packages/skill-family-harness-node &amp;&amp; pnpm pack --pack-destination &quot;$pack_dir&quot;)
 (cd packages/skill-family-engineering-kit &amp;&amp; pnpm pack --pack-destination &quot;$pack_dir&quot;)
 mkdir &quot;$pack_dir/consumer&quot; &amp;&amp; (cd &quot;$pack_dir/consumer&quot; &amp;&amp; npm init -y)
-(cd &quot;$pack_dir/consumer&quot; &amp;&amp; npm install &quot;$pack_dir/skill-family-contracts-&lt;version&gt;.tgz&quot; &quot;$pack_dir/skill-family-harness-node-&lt;version&gt;.tgz&quot; &quot;$pack_dir/skill-family-engineering-kit-&lt;version&gt;.tgz&quot;)
+(cd &quot;$pack_dir/consumer&quot; &amp;&amp; npm install &quot;$pack_dir/skill-family-contracts-${foundation_version}.tgz&quot; &quot;$pack_dir/skill-family-harness-node-${foundation_version}.tgz&quot; &quot;$pack_dir/skill-family-engineering-kit-${foundation_version}.tgz&quot;)
 </code></pre>
 <p>发布后安装状态页所列的精确坐标，再运行下文的 <code>npm exec</code> 命令。</p>
 <h2 id="新项目发现能力并生成骨架">新项目：发现能力并生成骨架<a class="headerlink" href="#新项目发现能力并生成骨架" title="Permanent link">&para;</a></h2>