skill-family-engineering-kit 0.19.3 → 0.21.0

package/CHANGELOG.md

@@ -1,5 +1,45 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.21.0 locale=en baseline=sha256:308114b76ba97466f58479dd0d5e4251ea8efba6ad291afc65236f26170229c5 -->
+## [0.21.0] - 2026-09-11
+
+Engineering Kit 0.21.0 adds `prepareHostVerification` for preparing one bounded Cursor invocation and reading its digest-bound private output through the existing host-verification path.
+
+### Added
+
+- Adds `prepareHostVerification`, which derives the fixed driver request, contained invocation directories, frozen snapshots, and private bindings from caller-owned candidate, workload, Skill, workspace, fixture, prompt, executable, and state-root inputs.
+- Adds `readInvocationStream` to the frozen preparation object so callers can read stdout or stderr only after the result, request, evidence-root binding, stream digest, and byte count match.
+
+### Changed
+
+- Rechecks bindings and source snapshots before process spawn, then compares the installed Skill closure digest before session creation or probing; drift and post-install digest mismatches fail closed.
+
+### Upgrade Notes
+
+Pin all three Foundation packages to exactly 0.21.0. The new preparation API supports only one declared Cursor Skill with the packaged `cursor-agent-print-v1` driver; workload meaning, domain assertions, release freshness, and cleanup remain caller responsibilities.
+<!-- release-skill:changelog:end version=0.21.0 locale=en -->
+
+
+<!-- release-skill:changelog:start version=0.20.0 locale=en baseline=sha256:4ea3064e77b2e33e76d1476f02f7d22920638e872cb87c098e8260f617081313 -->
+## [0.20.0] - 2026-09-10
+
+Engineering Kit 0.20.0 adds Cursor project Skill projection and a fixed Cursor Agent verification driver on the existing host-verification path.
+
+### Added
+
+- Registers `.cursor/skills` as the Cursor project Skill root while preserving manual lifecycle planning.
+- Adds `cursor-agent-print-v1` with fixed workspace, ask-mode, sandbox, JSON output, version, and failure checks.
+
+### Changed
+
+- Qualifies project-level Skill discovery through Cursor CLI menu discovery and one explicit invocation, without requiring a duplicate IDE check.
+
+### Upgrade Notes
+
+Pin all three Foundation packages to exactly 0.20.0 and rebuild official Bundles. Cursor stays manual/developer-preview; the driver does not add automatic trust, model selection, or Marketplace lifecycle management.
+<!-- release-skill:changelog:end version=0.20.0 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.19.3 locale=en baseline=sha256:a75e6ad165b31be8764c3f7e1b8048120f431d5da29e7bfdff5e4338d8fa896a -->
 ## [0.19.3] - 2026-09-08
 

package/CHANGELOG.zh-CN.md

@@ -1,5 +1,45 @@
 # 变更日志
 
+<!-- release-skill:changelog:start version=0.21.0 locale=zh-CN baseline=sha256:1f50ac51db5691c5c9dbe1014d0ab43e6cfa4eab1d60eb37a9ca74d30bc75890 -->
+## [0.21.0] - 2026-09-11
+
+Engineering Kit 0.21.0 增加 `prepareHostVerification`，在既有宿主验证路径上准备一次受约束的 Cursor 调用，并读取经过摘要绑定的私有输出。
+
+### 新增
+
+- 增加 `prepareHostVerification`。它从调用方持有的候选、工作负载、Skill、工作区、夹具、提示词、可执行文件和状态根输入派生固定驱动请求、受收容调用目录、冻结快照与私有绑定。
+- 冻结的准备对象增加 `readInvocationStream`。只有结果、请求、证据根绑定、流摘要和字节数一致时，调用方才能读取 stdout 或 stderr。
+
+### 变更
+
+- 启动进程前重新校验绑定与来源快照；创建会话或探测前比较安装后的 Skill 闭包摘要。发现漂移或摘要不匹配时失败关闭。
+
+### 升级说明
+
+三个 Foundation 包须一起精确锁定到 0.21.0。新准备接口只支持一个已声明的 Cursor Skill，并固定使用随包 `cursor-agent-print-v1` 驱动；工作负载含义、领域断言、发布新鲜度和清理由调用方负责。
+<!-- release-skill:changelog:end version=0.21.0 locale=zh-CN -->
+
+
+<!-- release-skill:changelog:start version=0.20.0 locale=zh-CN baseline=sha256:7f7e7f2175429d96720b04bb378afcb796e01f642abc0cdd7114fddf4a808b62 -->
+## [0.20.0] - 2026-09-10
+
+Engineering Kit 0.20.0 在既有宿主验证路径上增加 Cursor 项目级 Skill 投影和固定 Cursor Agent 验证驱动。
+
+### 新增
+
+- 登记 `.cursor/skills` 作为 Cursor 项目级 Skill 根，生命周期计划继续保持手动。
+- 增加 `cursor-agent-print-v1`，固定工作区、问答模式、沙箱、JSON 输出、版本与失败检查。
+
+### 变更
+
+- 通过 Cursor CLI 菜单发现和一次显式调用取得项目级 Skill 发现资格，不重复执行 IDE 图形界面检查。
+
+### 升级说明
+
+三个 Foundation 包须一起精确锁定到 0.20.0，并重建官方 Bundle。Cursor 继续保持 manual/developer-preview；驱动不增加自动信任、模型选择或 Marketplace 生命周期管理。
+<!-- release-skill:changelog:end version=0.20.0 locale=zh-CN -->
+
+
 <!-- release-skill:changelog:start version=0.19.3 locale=zh-CN baseline=sha256:16f48a8354216cfe0f1354bed02f0a5cee6ef0b9adaaad3339dc9f80c1070e2b -->
 ## [0.19.3] - 2026-09-08
 

package/README.md

@@ -4,22 +4,27 @@
 
 # skill-family-engineering-kit
 
-<!-- release-skill:release-version: 0.19.3 -->
+<!-- release-skill:release-version: 0.21.0 -->
 
 An engineering toolkit used in development and CI. There are **exactly four** top-level commands, and no fifth:
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.19.3** (2026-09-08)
+**0.21.0** (2026-09-11)
 
-Engineering Kit 0.19.3 aligns its package, release documentation, and generated projections with the Foundation Adoption Review Qoder distribution patch. Public commands and behavior are unchanged.
+Engineering Kit 0.21.0 adds `prepareHostVerification` for preparing one bounded Cursor invocation and reading its digest-bound private output through the existing host-verification path.
+
+**Added**
+
+- Adds `prepareHostVerification`, which derives the fixed driver request, contained invocation directories, frozen snapshots, and private bindings from caller-owned candidate, workload, Skill, workspace, fixture, prompt, executable, and state-root inputs.
+- Adds `readInvocationStream` to the frozen preparation object so callers can read stdout or stderr only after the result, request, evidence-root binding, stream digest, and byte count match.
 
 **Changed**
 
-- Aligns the package version, release documentation, and verified public package projection with Foundation 0.19.3 without adding a command, capability, or adapter path.
+- Rechecks bindings and source snapshots before process spawn, then compares the installed Skill closure digest before session creation or probing; drift and post-install digest mismatches fail closed.
 
 **Upgrade Notes**
 
-Pin all three Foundation packages to exactly 0.19.3 and rebuild official Bundles under the existing source-identity and integrity rules. The capability catalog, host descriptors, drivers, since values, and maturity are unchanged.
+Pin all three Foundation packages to exactly 0.21.0. The new preparation API supports only one declared Cursor Skill with the packaged `cursor-agent-print-v1` driver; workload meaning, domain assertions, release freshness, and cleanup remain caller responsibilities.
 <!-- release-skill:managed:end id=latest-release -->
 
 ### Foundation 0.15.0 candidate qualification entries
@@ -49,7 +54,7 @@ Kit is the "engineering stage" layer, depending on the Harness and Contracts. It
 
 ## Installation and Minimal Example
 
-Version 0.19.3 is the local source candidate. Build all three tarballs into one temporary directory and install those exact files for a candidate check:
+Version 0.21.0 is the local source candidate. Build all three tarballs into one temporary directory and install those exact files for a candidate check:
 
 ```sh
 pack_dir="$(mktemp -d)"
@@ -57,21 +62,21 @@ pack_dir="$(mktemp -d)"
 (cd packages/skill-family-harness-node && pnpm pack --pack-destination "$pack_dir")
 (cd packages/skill-family-engineering-kit && pnpm pack --pack-destination "$pack_dir")
 mkdir "$pack_dir/consumer" && (cd "$pack_dir/consumer" && npm init -y)
-(cd "$pack_dir/consumer" && npm install "$pack_dir/skill-family-contracts-0.19.3.tgz" "$pack_dir/skill-family-harness-node-0.19.3.tgz" "$pack_dir/skill-family-engineering-kit-0.19.3.tgz")
+(cd "$pack_dir/consumer" && npm install "$pack_dir/skill-family-contracts-0.21.0.tgz" "$pack_dir/skill-family-harness-node-0.21.0.tgz" "$pack_dir/skill-family-engineering-kit-0.21.0.tgz")
 ```
 
 After publication, use the registry coordinate:
 
 ```sh
-npm install --save-dev skill-family-engineering-kit@0.19.3
-npm exec --package=skill-family-engineering-kit@0.19.3 -- skill-family-kit --help
-npm exec --package=skill-family-engineering-kit@0.19.3 -- skill-family-kit scaffold --root <empty-dir> --project-id my-project
-npm exec --package=skill-family-engineering-kit@0.19.3 -- skill-family-kit adopt-plan --root <repo> --list-capabilities --all --scope all --locale en --uses ./uses.json
-npm exec --package=skill-family-engineering-kit@0.19.3 -- skill-family-kit projection --root <repo>
-npm exec --package=skill-family-engineering-kit@0.19.3 -- skill-family-kit check --root <repo>
+npm install --save-dev skill-family-engineering-kit@0.21.0
+npm exec --package=skill-family-engineering-kit@0.21.0 -- skill-family-kit --help
+npm exec --package=skill-family-engineering-kit@0.21.0 -- skill-family-kit scaffold --root <empty-dir> --project-id my-project
+npm exec --package=skill-family-engineering-kit@0.21.0 -- skill-family-kit adopt-plan --root <repo> --list-capabilities --all --scope all --locale en --uses ./uses.json
+npm exec --package=skill-family-engineering-kit@0.21.0 -- skill-family-kit projection --root <repo>
+npm exec --package=skill-family-engineering-kit@0.21.0 -- skill-family-kit check --root <repo>
 ```
 
-The four commands above cover skeleton generation, read-only inventory, managed projection, and diagnostics respectively; a zero-install form is available via `npm exec --package=skill-family-engineering-kit@0.19.3 -- skill-family-kit --help`.
+The four commands above cover skeleton generation, read-only inventory, managed projection, and diagnostics respectively; a zero-install form is available via `npm exec --package=skill-family-engineering-kit@0.21.0 -- skill-family-kit --help`.
 
 ### Three adoption journeys
 
@@ -165,6 +170,38 @@ The API keeps consumer workload, domain output checks, domain PASS/FAIL, release
 
 `executableSha256` binds only the bytes observed by the strict preflight read; the actual process is still spawned by pathname, so the caller must exclusively control the executable namespace through probe and invocation. Foundation retains the call's `session-*` directory and never deletes it by pathname. After inspection, the caller cleans its exclusively owned outer `temporaryRoot`.
 
+#### 0.21.0 candidate: prepare a Cursor invocation
+
+`prepareHostVerification` is a 0.21.0 candidate public API and has not yet been published remotely. The published 0.20.0 package does not contain this API. It prepares one declared Skill for `cursor`, using the packaged Descriptor and fixed `cursor-agent-print-v1` driver. It accepts no custom driver, arguments, model override, credential handling, or domain validator. The existing seven-driver `runHostVerification` entrypoint remains compatible.
+
+The caller supplies the following values; document and fixture content is an opaque UTF-8 string or Buffer. `skillMembers` must include `SKILL.md`; only declared members are installed. All roots must already exist as canonical absolute paths. `sessionRoot` must be empty and exclusively owned, and the workspace must be inside `repositoryRoot` (equality is allowed). The caller authorizes use of the existing user-state root and exclusively controls the executable namespace.
+
+```js
+import { prepareHostVerification, runHostVerification } from "skill-family-engineering-kit";
+
+const prepared = await prepareHostVerification({
+  hostId: "cursor", verificationSetId,
+  candidate: { ref: candidateRef, manifest: candidateManifest },
+  skill: { root: skillRoot, entrySkill, members: skillMembers },
+  workloadDocument, fixtureFiles, // [{ path: "input.json", content: fixtureBytes }]
+  workspace: { repositoryRoot, root: workspaceRoot, protectedMembers },
+  platformManifest, effectivePrompt,
+  executable: { root: executableRoot, relPath: "cursor-agent" },
+  existingUserStateRoot, sessionRoot,
+  timeoutPolicy: { schemaVersion: 1, kind: "skill-family.timeout-policy", maxSeconds: 60, killGraceSeconds: 1 },
+});
+const result = await runHostVerification(prepared);
+const stdout = result.streams
+  ? await prepared.readInvocationStream(result, "stdout")
+  : null;
+```
+
+Preparation copies input bytes, computes digests, freezes the request and private bindings, and creates contained documents and missing `.cursor/skills` parents without spawning a process or installing the Skill. Execution rechecks bindings and compares the installed Skill digest before any probe. Invalid fields, Schema failures, and mechanism failures use `SFC2003`, `SFC1001`, and `SFC2004`, respectively; preparation may leave partial files on a mechanism failure.
+
+`readInvocationStream(result, "stdout" | "stderr")` returns a Buffer only after checking the result, request binding, captured evidence root, stream digest, and byte count. It does not parse the answer or decide domain correctness. Missing streams or a read failure mean required business evidence is unavailable, not acceptance. The four states remain `observed`, `rejected`, `failed`, and `indeterminate`; `observed` is not a domain PASS. Only the validated result may enter a public report: the prepared object, raw streams, and error details stay private.
+
+The caller owns workload semantics, candidate-to-payload binding, domain assertions, release freshness, and resource cleanup. Keep the outer session and workspace handles before preparation; after a known outcome, read the evidence and confirm no process still uses the directories before cleanup. Preserve an `indeterminate` scene for the required manual actions; do not wrap the call in unconditional cleanup. A retry needs fresh roots and a new prepared object. These local fixture checks do not qualify a real host or prove model-driven Skill discovery.
+
 ## Typical Use Cases
 
 - New project skeleton: `scaffold` (does not overwrite a non-empty existing repo).
@@ -290,4 +327,4 @@ The candidate `runPluginVerification({ request, bindings, hostsRoot })` preserve
 
 The separate `runSkillFamilyDirectoryVerification({ request, bindings })` entry fixes the Kimi production argv and narrow environment and rejects caller observation. Its raw parser is exercised through the production process path, but no controlled fixture event is promoted to `observed`; without an official typed mapping, the public result remains `indeterminate` and a manual candidate.
 
-Version 0.19.3 is the local source candidate. Remote availability must be established by the corresponding release-skill post-release evidence. Consume the three locally verified tarballs for candidate checks; a version marker, unit test, or successful install is not complete contract integration, migration completion, or real-host qualification.
+Version 0.21.0 is the local source candidate. Remote availability must be established by the corresponding release-skill post-release evidence. Consume the three locally verified tarballs for candidate checks; a version marker, unit test, or successful install is not complete contract integration, migration completion, or real-host qualification.

package/README.zh-CN.md

@@ -5,22 +5,27 @@
 
 # skill-family-engineering-kit
 
-<!-- release-skill:release-version: 0.19.3 -->
+<!-- release-skill:release-version: 0.21.0 -->
 
 开发与 CI 阶段使用的工程工具包。**恰好四个**顶层命令，没有第五个：
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.19.3** (2026-09-08)
+**0.21.0** (2026-09-11)
 
-Engineering Kit 0.19.3 将包版本、发布文档和生成投影与 Foundation Adoption Review 的 Qoder 分发补丁对齐。公开命令和行为保持不变。
+Engineering Kit 0.21.0 增加 `prepareHostVerification`，在既有宿主验证路径上准备一次受约束的 Cursor 调用，并读取经过摘要绑定的私有输出。
+
+**新增**
+
+- 增加 `prepareHostVerification`。它从调用方持有的候选、工作负载、Skill、工作区、夹具、提示词、可执行文件和状态根输入派生固定驱动请求、受收容调用目录、冻结快照与私有绑定。
+- 冻结的准备对象增加 `readInvocationStream`。只有结果、请求、证据根绑定、流摘要和字节数一致时，调用方才能读取 stdout 或 stderr。
 
 **变更**
 
-- 包版本、发布文档和经验证的公开 package.json 投影与 Foundation 0.19.3 数值对齐，不增加命令、能力或 adapter 路径。
+- 启动进程前重新校验绑定与来源快照；创建会话或探测前比较安装后的 Skill 闭包摘要。发现漂移或摘要不匹配时失败关闭。
 
 **升级说明**
 
-三个 Foundation 包须一起精确锁定到 0.19.3，并按既有来源身份与完整性规则重建官方 Bundle。能力目录、宿主 descriptor、driver、since 字段和成熟度均不变。
+三个 Foundation 包须一起精确锁定到 0.21.0。新准备接口只支持一个已声明的 Cursor Skill，并固定使用随包 `cursor-agent-print-v1` 驱动；工作负载含义、领域断言、发布新鲜度和清理由调用方负责。
 <!-- release-skill:managed:end id=latest-release -->
 
 ### Foundation 0.15.0 candidate 资格入口
@@ -50,7 +55,7 @@ Kit 是「工程阶段」层，依赖 Harness 与 Contracts。它只做四件事
 
 ## 安装和最小示例
 
-0.19.3 是本地源码候选。候选验证先把三个包分别打入同一个临时目录，再安装这三个精确 tarball：
+0.21.0 是本地源码候选。候选验证先把三个包分别打入同一个临时目录，再安装这三个精确 tarball：
 
 ```sh
 pack_dir="$(mktemp -d)"
@@ -58,21 +63,21 @@ pack_dir="$(mktemp -d)"
 (cd packages/skill-family-harness-node && pnpm pack --pack-destination "$pack_dir")
 (cd packages/skill-family-engineering-kit && pnpm pack --pack-destination "$pack_dir")
 mkdir "$pack_dir/consumer" && (cd "$pack_dir/consumer" && npm init -y)
-(cd "$pack_dir/consumer" && npm install "$pack_dir/skill-family-contracts-0.19.3.tgz" "$pack_dir/skill-family-harness-node-0.19.3.tgz" "$pack_dir/skill-family-engineering-kit-0.19.3.tgz")
+(cd "$pack_dir/consumer" && npm install "$pack_dir/skill-family-contracts-0.21.0.tgz" "$pack_dir/skill-family-harness-node-0.21.0.tgz" "$pack_dir/skill-family-engineering-kit-0.21.0.tgz")
 ```
 
 发布后再使用 registry 坐标：
 
 ```sh
-npm install --save-dev skill-family-engineering-kit@0.19.3
-npm exec --package=skill-family-engineering-kit@0.19.3 -- skill-family-kit --help
-npm exec --package=skill-family-engineering-kit@0.19.3 -- skill-family-kit scaffold --root <empty-dir> --project-id my-project
-npm exec --package=skill-family-engineering-kit@0.19.3 -- skill-family-kit adopt-plan --root <repo> --list-capabilities --all --scope all --locale zh-CN --uses ./uses.json
-npm exec --package=skill-family-engineering-kit@0.19.3 -- skill-family-kit projection --root <repo>
-npm exec --package=skill-family-engineering-kit@0.19.3 -- skill-family-kit check --root <repo>
+npm install --save-dev skill-family-engineering-kit@0.21.0
+npm exec --package=skill-family-engineering-kit@0.21.0 -- skill-family-kit --help
+npm exec --package=skill-family-engineering-kit@0.21.0 -- skill-family-kit scaffold --root <empty-dir> --project-id my-project
+npm exec --package=skill-family-engineering-kit@0.21.0 -- skill-family-kit adopt-plan --root <repo> --list-capabilities --all --scope all --locale zh-CN --uses ./uses.json
+npm exec --package=skill-family-engineering-kit@0.21.0 -- skill-family-kit projection --root <repo>
+npm exec --package=skill-family-engineering-kit@0.21.0 -- skill-family-kit check --root <repo>
 ```
 
-以上四条命令分别覆盖生成骨架、只读盘点、受管投影与诊断；零安装形式可用 `npm exec --package=skill-family-engineering-kit@0.19.3 -- skill-family-kit --help`。
+以上四条命令分别覆盖生成骨架、只读盘点、受管投影与诊断；零安装形式可用 `npm exec --package=skill-family-engineering-kit@0.21.0 -- skill-family-kit --help`。
 
 ### 三条采用旅程
 
@@ -166,6 +171,40 @@ Profile 必须显式提供，Kit 不默认绑定具体宿主。规范宿主 ID
 
 `executableSha256` 只绑定启动前严格读取的字节，进程仍按路径启动；调用方须在版本观察和执行期间独占可执行文件命名空间。Foundation 保留 `session-*` 目录，调用方检查后清理独占的外层 `temporaryRoot`。
 
+#### 0.21.0 候选：准备 Cursor 调用
+
+`prepareHostVerification` 是 0.21.0 候选公开 API，尚未发布到远端；已发布的 0.20.0 包不包含该接口。它只为 `cursor` 准备单个已声明 Skill，使用随包 Descriptor（宿主描述符）和固定 `cursor-agent-print-v1` 驱动，不接受自定义驱动、参数、模型覆盖、凭据处理或领域验证器。原有七驱动的 `runHostVerification` 入口保持兼容。
+
+下例变量由调用方提供，文档和夹具内容为不透明的 UTF-8 字符串或 Buffer。`skillMembers` 必须包含 `SKILL.md`，安装只覆盖声明成员。各根目录须已存在，并使用规范绝对路径；`sessionRoot` 必须为空且由调用方独占，工作区必须位于 `repositoryRoot` 内，也允许两者相等。调用方授权使用现有用户状态根，并独占可执行文件命名空间。
+
+```js
+import { prepareHostVerification, runHostVerification } from "skill-family-engineering-kit";
+
+const prepared = await prepareHostVerification({
+  hostId: "cursor", verificationSetId,
+  candidate: { ref: candidateRef, manifest: candidateManifest },
+  skill: { root: skillRoot, entrySkill, members: skillMembers },
+  workloadDocument, fixtureFiles, // [{ path: "input.json", content: fixtureBytes }]
+  workspace: { repositoryRoot, root: workspaceRoot, protectedMembers },
+  platformManifest, effectivePrompt,
+  executable: { root: executableRoot, relPath: "cursor-agent" },
+  existingUserStateRoot, sessionRoot,
+  timeoutPolicy: { schemaVersion: 1, kind: "skill-family.timeout-policy", maxSeconds: 60, killGraceSeconds: 1 },
+});
+const result = await runHostVerification(prepared);
+const stdout = result.streams
+  ? await prepared.readInvocationStream(result, "stdout")
+  : null;
+```
+
+准备阶段复制输入字节、计算摘要并冻结请求与私有绑定。它在限定目录内写入文档、补齐缺失的 `.cursor/skills` 父目录，不启动进程，也不安装 Skill。执行阶段重新校验绑定，安装后的 Skill 摘要必须在任何探测前通过比较。字段错误、Schema 校验失败和机制失败分别沿用 `SFC2003`、`SFC1001`、`SFC2004`；准备过程的机制失败可能留下部分文件。
+
+`readInvocationStream(result, "stdout" | "stderr")` 校验结果、请求绑定、准备时捕获的证据根、流摘要和字节数后返回 Buffer，不解析答案或判断领域正确性。缺少流或读取失败表示必要业务证据尚不可用，不能据此通过验收。
+
+原四态仍为 `observed`、`rejected`、`failed`、`indeterminate`，其中 `observed` 不等于领域 PASS。只有经过校验的结果可以进入公共报告；准备对象、原始流及错误细节均须留在私有范围。
+
+工作负载语义、候选引用与载荷的绑定、领域断言、发布新鲜度和资源清理由调用方负责。调用方须在准备前持有外层会话目录与工作区的句柄。结果确定后，先读取证据并确认没有进程继续使用目录，再清理现场。`indeterminate` 必须保留现场并完成要求的人工动作，不能用无条件清理包住整次调用。重试须创建新的目录并重新准备。本地夹具检查不构成真实宿主资格，也不证明模型经宿主发现调用了 Skill。
+
 ## 典型使用场景
 
 - 新项目骨架：`scaffold`（不覆盖非空存量仓）。
@@ -291,4 +330,4 @@ Foundation 本身不发起网络请求，但绑定的 executable 仍可能联网
 
 独立入口 `runSkillFamilyDirectoryVerification({ request, bindings })` 固定 Kimi 生产 argv 与窄环境，并拒绝调用方 observation。原始 parser 通过生产进程路径验证，但受控 fixture 事件不会被提升为 `observed`；缺少官方 typed mapping 时，公共结果保持 `indeterminate` 和 manual candidate。
 
-0.19.3 是本地源码候选，远端可用性须由对应的 release-skill 发布后证据证明。候选检查使用本地已验证的三包 tarball；版本标记、单元测试或安装成功都不等于契约接入完成、迁移完成或真实宿主资格。
+0.21.0 是本地源码候选，远端可用性须由对应的 release-skill 发布后证据证明。候选检查使用本地已验证的三包 tarball；版本标记、单元测试或安装成功都不等于契约接入完成、迁移完成或真实宿主资格。

package/data/capability-catalog/capability-catalog.en.json

@@ -1290,7 +1290,8 @@
    "useWhen": [
     "Need to resolve a registered host or finite Profile alias",
     "Need to probe, build, plan, or locally install/update host integration",
-    "Need to verify caller-owned peer adapter projection roots without writing them"
+    "Need to verify caller-owned peer adapter projection roots without writing them",
+    "Need the unreleased Cursor single-Skill prepare → run → private stream reading API"
    ],
    "doNotUseWhen": [
     "Need remote host publication, automatic trust, or uninstall deletion",
@@ -1299,30 +1300,41 @@
    ],
    "prerequisites": [
     "The host Profile is registered in profiles/hosts and aliases are finite; npm consumers may explicitly select the Kit's packaged projection root",
-    "Trusted drivers are only claude-version-v1 / codex-version-v1"
+    "Trusted version-probe drivers are only claude-version-v1 / codex-version-v1",
+    "prepareHostVerification is an unreleased addition, not shipped in 0.20.0; it uses the packaged Cursor Descriptor and fixed cursor-agent-print-v1 verification driver",
+    "Preparation requires existing canonical roots, an empty exclusive sessionRoot, a workspace within repositoryRoot, and caller-authorized existing user state"
    ],
    "inputs": [
-    "Host identifier, finite Profile, probe/plan options, or a verified local operation input"
+    "Host identifier, finite Profile, probe/plan options, or a verified local operation input",
+    "Preparation: candidate ref and manifest bytes, declared Skill members including SKILL.md, workload and fixture bytes, protected workspace members, platform bytes, effectivePrompt, an explicitly bound cursor-agent executable, sessionRoot, existingUserStateRoot, and timeoutPolicy"
    ],
    "outputs": [
-    "Canonical host identity, independent probe facts, build artifacts, plan, local operation result, or a read-only peer-verification result"
+    "Canonical host identity, independent probe facts, build artifacts, plan, local operation result, or a read-only peer-verification result",
+    "Preparation returns frozen request/bindings, the packaged hostsRoot, and a private readInvocationStream(result, stdout|stderr) method returning a Buffer; runHostVerification retains observed/rejected/failed/indeterminate"
    ],
    "sideEffects": [
     "build/materialize writes artifacts at the contained target",
     "Probe does not spawn by default",
-    "verifyHostPeers reads caller-owned peer roots and writes no peer directory"
+    "verifyHostPeers reads caller-owned peer roots and writes no peer directory",
+    "Preparation copies opaque bytes and creates contained documents and missing discovery parents without spawning or installing Skill bytes; execution installs declared members and performs the fixed probe and invocation"
    ],
    "failureSemantics": [
-    "Hosts without a bound verification driver (e.g. codebuddy) are rejected before spawn with preflight-rejected",
+    "Hosts without a bound verification driver (e.g. deepseek-harness) are rejected before spawn with preflight-rejected",
     "Uninstall returns manual-recovery-required without deleting files",
-    "Missing probe facts, unknown projection categories, identity spoofing, or scope/anchor conflicts fail closed"
+    "Missing probe facts, unknown projection categories, identity spoofing, or scope/anchor conflicts fail closed",
+    "Preparation uses SFC2003 for invalid fields, SFC1001 for Schema failure, and SFC2004 for mechanism failure; partial private files may remain",
+    "Stream reads reject request/result mismatch, missing streams, replaced evidence roots, or digest/byte-count drift; unreadable required business evidence means incomplete verification, not acceptance"
    ],
    "invariants": [
     "HOST_DRIVER_IDS contains only the two trusted drivers",
-    "The nine capability facts are emitted independently; update operations require prior digests; manual projection categories do not grant build/plan/apply lifecycle support"
+    "The nine capability facts are emitted independently; update operations require prior digests; manual projection categories do not grant build/plan/apply lifecycle support",
+    "Preparation accepts only cursor, copies byte inputs and freezes bindings; the seven-driver runHostVerification remains compatible and checks installed bytes before the first spawn",
+    "No custom arguments, driver injection, model override, credential handling, or domain verdict; only validated four-state results are public, while prepared objects, streams, and error details remain private"
    ],
    "ownedByCaller": [
-    "Host business semantics"
+    "Host business semantics",
+    "Candidate-to-payload binding, workload semantics, business answer assertions, release freshness, and authorization to use existing user state",
+    "Exclusive namespaces and resource cleanup after evidence reading and confirmation that no process uses them; preserve indeterminate scenes for manual actions, and retry only with fresh roots and preparation"
    ],
    "routeElsewhere": [
     "Remote host publication and automatic trust: explicitly unsupported",

package/data/capability-catalog/capability-catalog.json

@@ -855,6 +855,7 @@
     "probeHost (packages/skill-family-engineering-kit/src/host.mjs)",
     "buildHostAdapter (packages/skill-family-engineering-kit/src/host.mjs)",
     "verifyHostPeers (packages/skill-family-engineering-kit/src/host.mjs)",
+    "prepareHostVerification (packages/skill-family-engineering-kit/src/host-verification.mjs)",
     "runHostVerification (packages/skill-family-engineering-kit/src/host-verification.mjs)",
     "verifyHostVerificationBindings (packages/skill-family-engineering-kit/src/host-verification.mjs)",
     "materializeHostBuild (packages/skill-family-engineering-kit/src/host.mjs)",
@@ -873,7 +874,8 @@
    ],
    "positiveTestRefs": [
     "packages/skill-family-engineering-kit/test/host.test.mjs",
-    "packages/skill-family-engineering-kit/test/host-verification.test.mjs"
+    "packages/skill-family-engineering-kit/test/host-verification.test.mjs",
+    "scripts/release-artifact-build.mjs"
    ],
    "negativeTestRefs": [
     "packages/skill-family-engineering-kit/test/host.test.mjs",

package/data/capability-catalog/capability-catalog.zh-CN.json

@@ -1289,7 +1289,8 @@
    "useWhen": [
     "需要解析已登记宿主或有限 Profile alias",
     "需要探测、构建、规划或本地 install/update 宿主接入",
-    "需要在不写入目录的前提下验证调用方拥有的同级适配器投影根"
+    "需要在不写入目录的前提下验证调用方拥有的同级适配器投影根",
+    "需要尚未发布的 Cursor 单 Skill 调用准备、执行及私有流读取 API"
    ],
    "doNotUseWhen": [
     "需要远端宿主发布、自动信任或删除式 uninstall",
@@ -1298,30 +1299,41 @@
    ],
    "prerequisites": [
     "宿主 Profile 已在 profiles/hosts 登记，alias 也必须来自有限集合；npm 消费者可显式选择 Kit 随包投影根",
-    "受信 driver 仅 claude-version-v1 / codex-version-v1"
+    "受信版本探测 driver 仅 claude-version-v1 / codex-version-v1",
+    "prepareHostVerification 是未发布增量，不属于 0.20.0 已发布 API；使用随包 Cursor Descriptor 和固定 cursor-agent-print-v1 验证驱动",
+    "准备需要已存在的规范根目录、为空且独占的 sessionRoot、位于 repositoryRoot 内的工作区，以及调用方授权使用的现有用户状态"
    ],
    "inputs": [
-    "宿主标识、有限 Profile、probe/plan 选项或已验证的本地操作输入"
+    "宿主标识、有限 Profile、probe/plan 选项或已验证的本地操作输入",
+    "准备输入：候选引用和清单字节、包含 SKILL.md 的 Skill 声明成员、工作负载与夹具字节、工作区受保护成员、平台文档字节、effectivePrompt、显式绑定的 cursor-agent 可执行文件、sessionRoot、existingUserStateRoot 和 timeoutPolicy"
    ],
    "outputs": [
-    "规范宿主身份、独立 probe fact、构建产物、plan、本地操作结果或只读同级验证结果"
+    "规范宿主身份、独立 probe fact、构建产物、plan、本地操作结果或只读同级验证结果",
+    "准备返回冻结的 request/bindings、随包 hostsRoot 及私有 readInvocationStream(result, stdout|stderr) 方法；该方法返回 Buffer，runHostVerification 仍返回 observed/rejected/failed/indeterminate 四态"
    ],
    "sideEffects": [
     "build/materialize 在受收容目标写产物",
     "probe 默认不 spawn",
-    "verifyHostPeers 只读取调用方拥有的 peer 根，不写入 peer 目录"
+    "verifyHostPeers 只读取调用方拥有的 peer 根，不写入 peer 目录",
+    "准备复制不透明字节，在限定目录内写入文档并补齐发现父目录，不启动进程或安装 Skill 字节；执行阶段安装声明成员并按固定参数探测和调用"
    ],
    "failureSemantics": [
-    "未绑定验证 driver 的宿主（如 codebuddy）在 spawn 前拒绝，标记 preflight-rejected",
+    "未绑定验证 driver 的宿主（如 deepseek-harness）在 spawn 前拒绝，标记 preflight-rejected",
     "uninstall 返回 manual-recovery-required 且不删除文件",
-    "缺 probe facts、未知投影类别、身份伪造或 scope/anchor 冲突均失败关闭"
+    "缺 probe facts、未知投影类别、身份伪造或 scope/anchor 冲突均失败关闭",
+    "准备阶段的字段错误、Schema 失败和机制失败分别沿用 SFC2003、SFC1001、SFC2004；失败可能留下部分私有文件",
+    "流读取拒绝请求与结果不匹配、缺少流、证据根被替换及摘要或字节数漂移；必要业务证据不可读表示验证未完成，不能据此通过验收"
    ],
    "invariants": [
     "HOST_DRIVER_IDS 仅两个受信 driver",
-    "九项能力事实逐项输出，update 必须绑定既有摘要；manual 投影类别不授予 build/plan/apply 生命周期能力"
+    "九项能力事实逐项输出，update 必须绑定既有摘要；manual 投影类别不授予 build/plan/apply 生命周期能力",
+    "准备入口只接受 cursor，复制输入字节并冻结绑定；原七驱动的 runHostVerification 保持兼容，并在首次启动前检查安装字节",
+    "不允许自定义参数、驱动注入、模型覆盖、凭据处理或领域裁决；只有经过校验的四态结果可公开，准备对象、流及错误细节均保持私有"
    ],
    "ownedByCaller": [
-    "宿主业务语义"
+    "宿主业务语义",
+    "候选引用与载荷绑定、工作负载语义、业务答案断言、发布新鲜度及现有用户状态的使用授权",
+    "命名空间独占与资源清理：读取证据并确认没有进程继续使用目录后再清理；indeterminate 保留现场供人工处理，重试须使用新目录并重新准备"
    ],
    "routeElsewhere": [
     "远端宿主发布和自动信任：明确 unsupported",

package/data/hosts/cursor/host-descriptor.json

@@ -0,0 +1,34 @@
+{
+  "schemaVersion": 1,
+  "kind": "skill-family.host-descriptor",
+  "hostId": "cursor",
+  "displayName": "Cursor",
+  "support": "manual",
+  "maturity": "developer-preview",
+  "sourceAliases": [],
+  "verification": {
+    "driverId": "cursor-agent-print-v1",
+    "authStrategy": "existing-user-state",
+    "credentialMutation": "host-managed"
+  },
+  "pathCategories": [
+    {
+      "id": "cursor-project-skills",
+      "role": "skill-root",
+      "scope": "project",
+      "anchor": "project-root",
+      "relPath": ".cursor/skills"
+    }
+  ],
+  "probeCapabilities": [
+    "cli",
+    "version",
+    "payload",
+    "registry",
+    "discover",
+    "enabled",
+    "reload",
+    "smoke",
+    "uninstall"
+  ]
+}

package/data/hosts/registry.json

@@ -4,6 +4,7 @@
   "hosts": [
     "claude",
     "codex",
+    "cursor",
     "kimi-code",
     "workbuddy",
     "codebuddy",

package/docs/agents/capability-catalog.en.json

@@ -1290,7 +1290,8 @@
    "useWhen": [
     "Need to resolve a registered host or finite Profile alias",
     "Need to probe, build, plan, or locally install/update host integration",
-    "Need to verify caller-owned peer adapter projection roots without writing them"
+    "Need to verify caller-owned peer adapter projection roots without writing them",
+    "Need the unreleased Cursor single-Skill prepare → run → private stream reading API"
    ],
    "doNotUseWhen": [
     "Need remote host publication, automatic trust, or uninstall deletion",
@@ -1299,30 +1300,41 @@
    ],
    "prerequisites": [
     "The host Profile is registered in profiles/hosts and aliases are finite; npm consumers may explicitly select the Kit's packaged projection root",
-    "Trusted drivers are only claude-version-v1 / codex-version-v1"
+    "Trusted version-probe drivers are only claude-version-v1 / codex-version-v1",
+    "prepareHostVerification is an unreleased addition, not shipped in 0.20.0; it uses the packaged Cursor Descriptor and fixed cursor-agent-print-v1 verification driver",
+    "Preparation requires existing canonical roots, an empty exclusive sessionRoot, a workspace within repositoryRoot, and caller-authorized existing user state"
    ],
    "inputs": [
-    "Host identifier, finite Profile, probe/plan options, or a verified local operation input"
+    "Host identifier, finite Profile, probe/plan options, or a verified local operation input",
+    "Preparation: candidate ref and manifest bytes, declared Skill members including SKILL.md, workload and fixture bytes, protected workspace members, platform bytes, effectivePrompt, an explicitly bound cursor-agent executable, sessionRoot, existingUserStateRoot, and timeoutPolicy"
    ],
    "outputs": [
-    "Canonical host identity, independent probe facts, build artifacts, plan, local operation result, or a read-only peer-verification result"
+    "Canonical host identity, independent probe facts, build artifacts, plan, local operation result, or a read-only peer-verification result",
+    "Preparation returns frozen request/bindings, the packaged hostsRoot, and a private readInvocationStream(result, stdout|stderr) method returning a Buffer; runHostVerification retains observed/rejected/failed/indeterminate"
    ],
    "sideEffects": [
     "build/materialize writes artifacts at the contained target",
     "Probe does not spawn by default",
-    "verifyHostPeers reads caller-owned peer roots and writes no peer directory"
+    "verifyHostPeers reads caller-owned peer roots and writes no peer directory",
+    "Preparation copies opaque bytes and creates contained documents and missing discovery parents without spawning or installing Skill bytes; execution installs declared members and performs the fixed probe and invocation"
    ],
    "failureSemantics": [
-    "Hosts without a bound verification driver (e.g. codebuddy) are rejected before spawn with preflight-rejected",
+    "Hosts without a bound verification driver (e.g. deepseek-harness) are rejected before spawn with preflight-rejected",
     "Uninstall returns manual-recovery-required without deleting files",
-    "Missing probe facts, unknown projection categories, identity spoofing, or scope/anchor conflicts fail closed"
+    "Missing probe facts, unknown projection categories, identity spoofing, or scope/anchor conflicts fail closed",
+    "Preparation uses SFC2003 for invalid fields, SFC1001 for Schema failure, and SFC2004 for mechanism failure; partial private files may remain",
+    "Stream reads reject request/result mismatch, missing streams, replaced evidence roots, or digest/byte-count drift; unreadable required business evidence means incomplete verification, not acceptance"
    ],
    "invariants": [
     "HOST_DRIVER_IDS contains only the two trusted drivers",
-    "The nine capability facts are emitted independently; update operations require prior digests; manual projection categories do not grant build/plan/apply lifecycle support"
+    "The nine capability facts are emitted independently; update operations require prior digests; manual projection categories do not grant build/plan/apply lifecycle support",
+    "Preparation accepts only cursor, copies byte inputs and freezes bindings; the seven-driver runHostVerification remains compatible and checks installed bytes before the first spawn",
+    "No custom arguments, driver injection, model override, credential handling, or domain verdict; only validated four-state results are public, while prepared objects, streams, and error details remain private"
    ],
    "ownedByCaller": [
-    "Host business semantics"
+    "Host business semantics",
+    "Candidate-to-payload binding, workload semantics, business answer assertions, release freshness, and authorization to use existing user state",
+    "Exclusive namespaces and resource cleanup after evidence reading and confirmation that no process uses them; preserve indeterminate scenes for manual actions, and retry only with fresh roots and preparation"
    ],
    "routeElsewhere": [
     "Remote host publication and automatic trust: explicitly unsupported",

package/docs/agents/capability-catalog.json

@@ -855,6 +855,7 @@
     "probeHost (packages/skill-family-engineering-kit/src/host.mjs)",
     "buildHostAdapter (packages/skill-family-engineering-kit/src/host.mjs)",
     "verifyHostPeers (packages/skill-family-engineering-kit/src/host.mjs)",
+    "prepareHostVerification (packages/skill-family-engineering-kit/src/host-verification.mjs)",
     "runHostVerification (packages/skill-family-engineering-kit/src/host-verification.mjs)",
     "verifyHostVerificationBindings (packages/skill-family-engineering-kit/src/host-verification.mjs)",
     "materializeHostBuild (packages/skill-family-engineering-kit/src/host.mjs)",
@@ -873,7 +874,8 @@
    ],
    "positiveTestRefs": [
     "packages/skill-family-engineering-kit/test/host.test.mjs",
-    "packages/skill-family-engineering-kit/test/host-verification.test.mjs"
+    "packages/skill-family-engineering-kit/test/host-verification.test.mjs",
+    "scripts/release-artifact-build.mjs"
    ],
    "negativeTestRefs": [
     "packages/skill-family-engineering-kit/test/host.test.mjs",