skill-family-engineering-kit 0.2.1 → 0.3.0

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.3.0 locale=en baseline=sha256:4c017d6121ff888f90ad9a4ef958b4fee3e25c8d1b69be61cc1ba1f79d527163 -->
+## [0.3.0] - 2026-08-12
+
+This source candidate builds a deterministic Quickstart Profile v2 bundle that runs offline without Foundation packages, node_modules, or runtime Ajv.
+
+### Added
+
+- Accepts explicit consumer schema files and source identity, then generates standalone validators selected by schema $id.
+- Records complete source and payload provenance, package-manager identity, and the licenses for third-party code that enters the bundle.
+- Adds a candidate plugin skill naming checker (policy JSON plus build-time CLI) that scans a plugin skills root and reports per-rule PASS/FAIL for the prefixed-name, description-signal, and routing-scope rules.
+
+### Changed
+
+- Replaces the incompatible 0.2.1 dependency-closure bundle; consumers that still require v1 must remain pinned to exactly 0.2.1.
+- Projects the Contracts and Harness runtime mechanically while preserving the stable four-command Kit surface.
+
+### Upgrade Notes
+
+Version 0.3.0 is a local, unpublished source candidate. Regenerate managed bundles from frozen inputs and pin the builder to exactly 0.3.0 when adopting v2.
+<!-- release-skill:changelog:end version=0.3.0 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.2.1 locale=en baseline=sha256:3457c97a9a2f25fd233a1947dcd9c88fb40279e90ae5b437bea1f7660ac6ce60 -->
 ## [0.2.1] - 2026-08-10
 

package/CHANGELOG.zh-CN.md

@@ -1,5 +1,27 @@
 # 变更日志
 
+<!-- release-skill:changelog:start version=0.3.0 locale=zh-CN baseline=sha256:ddb48e61ef87de545348880216ee283b5d0165305dd5dfd8e044929b93ec4673 -->
+## [0.3.0] - 2026-08-12
+
+本源码候选版构建确定性的 Quickstart Profile v2 Bundle，运行时不依赖 Foundation 包、node_modules 或 Ajv。
+
+### 新增
+
+- 接收显式消费者 Schema 文件与来源身份，生成按 Schema $id 选择的 standalone validator。
+- 完整记录来源与 payload provenance、包管理器身份，以及实际进入 Bundle 的第三方代码许可证。
+- 新增候选插件技能命名检查器（policy JSON 加构建期 CLI）：扫描插件 skills 根目录，对前缀命名、description 领域信号与路由入口范围三条规则逐项输出 PASS/FAIL。
+
+### 变更
+
+- 替换与 0.2.1 不兼容的依赖闭包 Bundle；仍依赖 v1 的消费者必须继续精确锁定 0.2.1。
+- 机械投影 Contracts 与 Harness 运行代码，同时保持 Kit 稳定的四命令边界。
+
+### 升级说明
+
+0.3.0 当前只是本地、未发布的源码候选。采用 v2 时，应从冻结输入重新生成受管 Bundle，并把 builder 精确锁定为 0.3.0。
+<!-- release-skill:changelog:end version=0.3.0 locale=zh-CN -->
+
+
 <!-- release-skill:changelog:start version=0.2.1 locale=zh-CN baseline=sha256:f43f41fadfa1dc9affd87825a382af6aed91050ef36a0c0854a6b04c2ba7fcea -->
 ## [0.2.1] - 2026-08-10
 

package/README.md

@@ -4,28 +4,29 @@
 
 # skill-family-engineering-kit
 
-<!-- release-skill:release-version: 0.2.1 -->
+<!-- release-skill:release-version: 0.3.0 -->
 
 An engineering toolkit used in development and CI. There are **exactly four** top-level commands, and no fifth:
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.2.1** (2026-08-10)
+**0.3.0** (2026-08-12)
 
-This release adds a candidate Quickstart Profile projection bundle while preserving the Kit's four-command boundary and adds bilingual package release documentation.
+This source candidate builds a deterministic Quickstart Profile v2 bundle that runs offline without Foundation packages, node_modules, or runtime Ajv.
 
 **Added**
 
-- Adds a candidate builder and CLI for a deterministic, self-contained Quickstart Profile projection bundle with source-closure and bundle digests.
-- Adds complete English and Simplified Chinese package documentation, including an agent quick-reference section.
+- Accepts explicit consumer schema files and source identity, then generates standalone validators selected by schema $id.
+- Records complete source and payload provenance, package-manager identity, and the licenses for third-party code that enters the bundle.
+- Adds a candidate plugin skill naming checker (policy JSON plus build-time CLI) that scans a plugin skills root and reports per-rule PASS/FAIL for the prefixed-name, description-signal, and routing-scope rules.
 
 **Changed**
 
-- Manages the current README and CHANGELOG release sections from one bilingual, versioned notes source.
-- Distributes the project NOTICE separately from the existing third-party notices and license closure.
+- Replaces the incompatible 0.2.1 dependency-closure bundle; consumers that still require v1 must remain pinned to exactly 0.2.1.
+- Projects the Contracts and Harness runtime mechanically while preserving the stable four-command Kit surface.
 
 **Upgrade Notes**
 
-The candidate bundle remains under the existing projection authorization boundary. It does not add a fifth top-level Kit command or replace THIRD_PARTY_NOTICES.
+Version 0.3.0 is a local, unpublished source candidate. Regenerate managed bundles from frozen inputs and pin the builder to exactly 0.3.0 when adopting v2.
 <!-- release-skill:managed:end id=latest-release -->
 
 | Command | Purpose | Side effects |
@@ -46,7 +47,7 @@ Kit is the "engineering stage" layer, depending on the Harness and Contracts. It
 ## Installation and Minimal Example
 
 ```sh
-npm install --save-dev skill-family-engineering-kit@0.2.1
+npm install --save-dev skill-family-engineering-kit@0.3.0
 npm exec -- skill-family-kit --help
 npm exec -- skill-family-kit scaffold --root <empty-dir> --project-id my-project
 npm exec -- skill-family-kit adopt-plan --root <repo>
@@ -54,7 +55,7 @@ npm exec -- skill-family-kit projection --root <repo>
 npm exec -- skill-family-kit check --root <repo>
 ```
 
-The four commands above cover skeleton generation, read-only inventory, managed projection, and diagnostics respectively; a zero-install form is available via `npm exec --package=skill-family-engineering-kit@0.2.1 -- skill-family-kit --help`.
+The four commands above cover skeleton generation, read-only inventory, managed projection, and diagnostics respectively; a zero-install form is available via `npm exec --package=skill-family-engineering-kit@0.3.0 -- skill-family-kit --help`.
 
 ### Report sub-action
 
@@ -67,7 +68,7 @@ The caller must first construct a valid report model; Kit does not derive facts
 
 ### Candidate Quickstart projection bundle
 
-Use the candidate subpath to build a deterministic projection manifest containing the Quickstart Profile schemas, runner, and required runtime dependency closure:
+Use the candidate subpath to build a deterministic Quickstart Profile v2 projection from explicit consumer schemas and frozen source identity:
 
 ```js
 import {
@@ -76,7 +77,9 @@ import {
 } from "skill-family-engineering-kit/candidate/quickstart-profile";
 ```
 
-Pass the returned `manifest` to the stable `runProjection` API; the candidate helper does not write files or add a fifth top-level command. This subpath is public but **not stable** and may change or be removed in a later minor release. Pin the exact package version, inspect the returned manifest before authorization, and keep candidate imports outside a stable consumer API.
+The generated Bundle selects standalone validators by schema `$id` and runs offline without Foundation packages, `node_modules`, or runtime Ajv. Its provenance binds Foundation sources, consumer schemas, payload bytes, tool versions, and the licenses of code that actually enters the Bundle.
+
+Pass the returned `manifest` to the stable `runProjection` API; the helper does not write files or add a fifth top-level command. This subpath is public but **not stable**. Pin exactly `0.3.0` for v2; integrations that still require the v1 dependency-closure Bundle must stay pinned to exactly `0.2.1`.
 
 ### Host sub-action
 

package/README.zh-CN.md

@@ -5,28 +5,29 @@
 
 # skill-family-engineering-kit
 
-<!-- release-skill:release-version: 0.2.1 -->
+<!-- release-skill:release-version: 0.3.0 -->
 
 开发与 CI 阶段使用的工程工具包。**恰好四个**顶层命令，没有第五个：
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.2.1** (2026-08-10)
+**0.3.0** (2026-08-12)
 
-本版新增 Quickstart Profile 候选投影包，同时保持 Kit 四命令边界，并补齐双语包发布文档。
+本源码候选版构建确定性的 Quickstart Profile v2 Bundle，运行时不依赖 Foundation 包、node_modules 或 Ajv。
 
 **新增**
 
-- 新增候选构建函数与 CLI，用于生成确定性、自包含的 Quickstart Profile 投影包，并记录源码闭包与投影包摘要。
-- 新增完整的英文与简体中文包文档，并补充智能体快速参考章节。
+- 接收显式消费者 Schema 文件与来源身份，生成按 Schema $id 选择的 standalone validator。
+- 完整记录来源与 payload provenance、包管理器身份，以及实际进入 Bundle 的第三方代码许可证。
+- 新增候选插件技能命名检查器（policy JSON 加构建期 CLI）：扫描插件 skills 根目录，对前缀命名、description 领域信号与路由入口范围三条规则逐项输出 PASS/FAIL。
 
 **变更**
 
-- 使用同一份双语版本化说明源管理当前 README 与 CHANGELOG 的发布区域。
-- 项目 NOTICE 与现有第三方声明及许可证闭包分开分发。
+- 替换与 0.2.1 不兼容的依赖闭包 Bundle；仍依赖 v1 的消费者必须继续精确锁定 0.2.1。
+- 机械投影 Contracts 与 Harness 运行代码，同时保持 Kit 稳定的四命令边界。
 
 **升级说明**
 
-候选投影包仍受既有 projection 授权边界约束。它不增加第五个 Kit 顶层命令，也不替代 THIRD_PARTY_NOTICES。
+0.3.0 当前只是本地、未发布的源码候选。采用 v2 时，应从冻结输入重新生成受管 Bundle，并把 builder 精确锁定为 0.3.0。
 <!-- release-skill:managed:end id=latest-release -->
 
 | 命令 | 用途 | 副作用 |
@@ -47,7 +48,7 @@ Kit 是「工程阶段」层，依赖 Harness 与 Contracts。它只做四件事
 ## 安装和最小示例
 
 ```sh
-npm install --save-dev skill-family-engineering-kit@0.2.1
+npm install --save-dev skill-family-engineering-kit@0.3.0
 npm exec -- skill-family-kit --help
 npm exec -- skill-family-kit scaffold --root <empty-dir> --project-id my-project
 npm exec -- skill-family-kit adopt-plan --root <repo>
@@ -55,7 +56,7 @@ npm exec -- skill-family-kit projection --root <repo>
 npm exec -- skill-family-kit check --root <repo>
 ```
 
-以上四条命令分别覆盖生成骨架、只读盘点、受管投影与诊断；零安装形式可用 `npm exec --package=skill-family-engineering-kit@0.2.1 -- skill-family-kit --help`。
+以上四条命令分别覆盖生成骨架、只读盘点、受管投影与诊断；零安装形式可用 `npm exec --package=skill-family-engineering-kit@0.3.0 -- skill-family-kit --help`。
 
 ### 报告子动作
 
@@ -68,7 +69,7 @@ npm exec -- skill-family-kit check report --root <repo> --report <report.md> --m
 
 ### Candidate Quickstart 投影包
 
-需要生成确定性的投影 manifest，并携带 Quickstart Profile Schema、runner 与必要运行时依赖闭包时，使用 candidate 子路径：
+需要从显式消费者 Schema 与冻结来源身份生成确定性的 Quickstart Profile v2 投影时，使用 candidate 子路径：
 
 ```js
 import {
@@ -77,7 +78,9 @@ import {
 } from "skill-family-engineering-kit/candidate/quickstart-profile";
 ```
 
-以上辅助函数不写文件，也不增加第五个顶层命令。调用方需要把返回的 `manifest` 交给稳定的 `runProjection` API。该子路径公开但**不稳定**，后续小版本可以修改或移除；调用方需要锁定精确包版本，在授权前检查 manifest，并避免通过自身稳定 API 再导出 candidate 导入。
+生成的 Bundle 按 Schema `$id` 选择 standalone validator，离线运行时不依赖 Foundation 包、`node_modules` 或 Ajv。provenance 绑定 Foundation 来源、消费者 Schema、payload 字节、工具版本，以及实际进入 Bundle 的代码许可证。
+
+以上辅助函数不写文件，也不增加第五个顶层命令。调用方需要把返回的 `manifest` 交给稳定的 `runProjection` API。该子路径公开但**不稳定**；使用 v2 时应精确锁定 `0.3.0`，仍依赖 v1 依赖闭包 Bundle 的接入必须继续精确锁定 `0.2.1`。
 
 ### 宿主子动作