skill-family-engineering-kit 0.24.0 → 0.25.0

package/CHANGELOG.md

@@ -1,5 +1,38 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.25.0 locale=en baseline=sha256:94f4c9be64b930538ffaccf847dadf49baad796b513c142205a18f631d50e66c -->
+## [0.25.0] - 2026-10-15
+
+Engineering Kit 0.25.0 adds the public function `runHostLoadingCheck` and the CLI sub-action `skill-family-kit check host-loading` under the existing `check` command. The four top-level commands remain `scaffold`, `adopt-plan`, `projection`, and `check`. The check covers only Codex CLI 0.154.0 project `.agents/skills`. Unknown coverage returns exit code 2. A static result does not prove install, session selection, or business execution.
+
+### Changed
+
+- Add the public function `runHostLoadingCheck` and the CLI `skill-family-kit check host-loading`. The API `root` must be an absolute project working directory; the CLI resolves the current directory or a relative path to an absolute path first.
+- Only `hostId=codex`, `hostVersion=0.154.0`, and `pathCategory=codex-project-skills` are calibrated, and that category's relative path must remain `.agents/skills`. The check statically reads `SKILL.md` and the optional Codex 0.154.0 skill metadata YAML under `agents/` beside `SKILL.md`. It does not start a host, model, hook, or script, and writes nothing.
+- Other hosts or versions, or an unknown path category, return exit code 2. A missing skill entry, or a scope that contains only product-filtered targets, returns 1. A static pass does not prove real install, session selection, or business execution.
+- The package moves to 0.25.0 with the other three units. Contracts specification remains 1.20.0. Published 0.24.1 capabilities are unchanged and are not redone.
+
+### Upgrade Notes
+
+Pin the three Foundation npm packages to exactly 0.25.0 and keep the independent Plugin at that release version. Contracts specification 1.20.0 remains a separate coordinate from npm package versions. Consume the actual published version's public interfaces and sources. A static check pass does not prove real install, session selection, or business execution. This note does not replace post-publish verification.
+<!-- release-skill:changelog:end version=0.25.0 locale=en -->
+
+
+<!-- release-skill:changelog:start version=0.24.1 locale=en baseline=sha256:60780ae0d34a8e8fcc016ebb188586876b9c31ceafb0c02a826db8e449e43729 -->
+## [0.24.1] - 2026-10-12
+
+Engineering Kit 0.24.1 advances only to keep the existing four-unit lockstep contract for the Foundation documentation patch. It adds no capability, API, Schema, protocol, or mechanism.
+
+### Changed
+
+- Update only the package coordinate and its managed version projections; existing capabilities, parameters, and failure boundaries remain unchanged.
+
+### Upgrade Notes
+
+Pin the three Foundation npm packages to the exact same version and keep the independent Plugin at that release version. Contracts specification 1.20.0 remains a separate coordinate from npm package versions. Use the actual published version's public interfaces and sources; this note does not replace post-publish verification.
+<!-- release-skill:changelog:end version=0.24.1 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.24.0 locale=en baseline=sha256:ab4ce0e2c0eb82f9d7b97bd2d48a040965596785dab29dd8898dbe5730acd303 -->
 ## [0.24.0] - 2026-10-07
 

package/CHANGELOG.zh-CN.md

@@ -1,5 +1,38 @@
 # 变更日志
 
+<!-- release-skill:changelog:start version=0.25.0 locale=zh-CN baseline=sha256:0112af28c40f4ac8dd77173f681345039eb2c55d714315b267827693c5f78e37 -->
+## [0.25.0] - 2026-10-15
+
+Engineering Kit 0.25.0 在既有 `check` 下新增公共函数 `runHostLoadingCheck` 与 CLI 子动作 `skill-family-kit check host-loading`。四个顶层命令仍为 `scaffold`、`adopt-plan`、`projection`、`check`。检查只覆盖 Codex CLI 0.154.0 的项目 `.agents/skills`。未知覆盖返回退出码 2。静态结果不证明安装、会话选择或业务执行。
+
+### 变更
+
+- 新增公共函数 `runHostLoadingCheck` 与 CLI `skill-family-kit check host-loading`。API 的 `root` 必须是绝对项目工作目录；CLI 会把当前目录或相对路径先解析成绝对路径。
+- 只校准 `hostId=codex`、`hostVersion=0.154.0`、`pathCategory=codex-project-skills`，且该类别相对路径必须仍是 `.agents/skills`。检查静态读取所选项目根下 `.agents/skills` 的 `SKILL.md`，以及 `SKILL.md` 旁 `agents/` 下 Codex 0.154.0 的可选技能元信息 YAML。不启动宿主、模型、hook 或脚本，不写文件。
+- 其他宿主或版本、未知路径类别返回退出码 2。缺技能入口，或范围内仅有被产品过滤的目标，返回 1。静态通过不证明真实安装、会话选择或业务执行。
+- 包版本与其他三单元锁步到 0.25.0。Contracts 规格仍为 1.20.0。已发布的 0.24.1 能力保持原样，本版本不重做。
+
+### 升级说明
+
+三个 Foundation npm 包须精确锁定 0.25.0，独立插件与三包保持相同发布版本。Contracts 规格仍为 1.20.0，与 npm 包版本分别处理。消费以实际发布版本的公开接口和源码为准。静态检查通过不证明真实安装、会话选择或业务执行。本说明不替代发布后验证。
+<!-- release-skill:changelog:end version=0.25.0 locale=zh-CN -->
+
+
+<!-- release-skill:changelog:start version=0.24.1 locale=zh-CN baseline=sha256:0d0b6cccd46c69014e89efa21677ef015ccd3085f0fd07e8021b364b1c1f47e6 -->
+## [0.24.1] - 2026-10-12
+
+Engineering Kit 0.24.1 仅随 Foundation 文档补丁按既有四单元合同锁步前移，没有新增能力、API、Schema、协议或机制。
+
+### 变更
+
+- 仅更新包版本和相应受管版本派生；现有能力、参数与失败边界保持不变。
+
+### 升级说明
+
+三个 Foundation npm 包须精确锁定同版，独立插件与三包保持相同发布版本。Contracts 规格仍为 1.20.0，与 npm 包版本分别处理；消费以实际发布版本的公开接口和来源为准，本说明不替代发布后验证。
+<!-- release-skill:changelog:end version=0.24.1 locale=zh-CN -->
+
+
 <!-- release-skill:changelog:start version=0.24.0 locale=zh-CN baseline=sha256:0ae5e1d34d13be6d56f72e4c77ab44e4d24e0e4d5f562ab424d104795db770eb -->
 ## [0.24.0] - 2026-10-07
 

package/README.md

@@ -4,26 +4,25 @@
 
 # skill-family-engineering-kit
 
-<!-- release-skill:release-version: 0.24.0 -->
+<!-- release-skill:release-version: 0.25.0 -->
 
 An engineering toolkit used in development and CI. There are **exactly four** top-level commands, and no fifth:
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.24.0** (2026-10-07)
+**0.25.0** (2026-10-15)
 
-Engineering Kit 0.24.0 adds explicit persistent-tool-lock registration within the existing check relock transaction. The four top-level commands remain scaffold, adopt-plan, projection, and check. This note records the local lockstep candidate, not completed remote publication or real-consumer adoption.
+Engineering Kit 0.25.0 adds the public function `runHostLoadingCheck` and the CLI sub-action `skill-family-kit check host-loading` under the existing `check` command. The four top-level commands remain `scaffold`, `adopt-plan`, `projection`, and `check`. The check covers only Codex CLI 0.154.0 project `.agents/skills`. Unknown coverage returns exit code 2. A static result does not prove install, session selection, or business execution.
 
 **Changed**
 
-- The API registrationClass accepts only handwritten or trackedToolLocks; the CLI uses --registration-class. The default remains handwritten, including its existing automatic discovery when the files list is absent or empty.
-- The trackedToolLocks mode requires an explicit non-empty files list, supplied with --files in the CLI. Every path must identify an existing ordinary file inside the target. It does not discover tool locks automatically or infer tool semantics from names or content.
-- The same transaction initializes entries when classes.trackedToolLocks is absent, then appends the explicit paths. An existing malformed class or non-array entries is refused before the first write. Other classes remain unchanged.
-- Only .foundation/file-registry.json and skill-family.managed-file-lock.json are updated. Tool-lock content is excluded from managed hashes, so a later provider update does not itself cause managed drift. Existing path, symlink, prior-registration, state-document, and managed-drift refusals remain. A mid-publication failure still exposes publicationState; no atomic rollback of both documents is promised.
-- The package moves to 0.24.0 with the other three units. Contracts stays specification 1.20.0, with no new contract object, Harness mechanism, or report kind. Historical 0.23.1 notes remain unchanged.
+- Add the public function `runHostLoadingCheck` and the CLI `skill-family-kit check host-loading`. The API `root` must be an absolute project working directory; the CLI resolves the current directory or a relative path to an absolute path first.
+- Only `hostId=codex`, `hostVersion=0.154.0`, and `pathCategory=codex-project-skills` are calibrated, and that category's relative path must remain `.agents/skills`. The check statically reads `SKILL.md` and the optional Codex 0.154.0 skill metadata YAML under `agents/` beside `SKILL.md`. It does not start a host, model, hook, or script, and writes nothing.
+- Other hosts or versions, or an unknown path category, return exit code 2. A missing skill entry, or a scope that contains only product-filtered targets, returns 1. A static pass does not prove real install, session selection, or business execution.
+- The package moves to 0.25.0 with the other three units. Contracts specification remains 1.20.0. Published 0.24.1 capabilities are unchanged and are not redone.
 
 **Upgrade Notes**
 
-Pin all three Foundation npm packages to exactly 0.24.0. The new registration mode belongs to this candidate and is not a published 0.23.0 capability; adoption depends on the corresponding released public interface. Complete consumer, initialization, and release qualification remain to be verified.
+Pin the three Foundation npm packages to exactly 0.25.0 and keep the independent Plugin at that release version. Contracts specification 1.20.0 remains a separate coordinate from npm package versions. Consume the actual published version's public interfaces and sources. A static check pass does not prove real install, session selection, or business execution. This note does not replace post-publish verification.
 <!-- release-skill:managed:end id=latest-release -->
 
 ## Governance Check (0.22.0)
@@ -66,7 +65,7 @@ Kit is the "engineering stage" layer, depending on the Harness and Contracts. It
 
 ## Installation and Minimal Example
 
-Version 0.24.0 is the local source candidate and is not yet formally published. Version 0.23.0 remains the published package. Build all three tarballs into one temporary directory and install those exact files for a candidate check:
+This package version is 0.25.0; version 0.24.1 has been formally published. To verify a working tree before formal publication, build all three tarballs into one temporary directory and install those exact files:
 
 ```sh
 pack_dir="$(mktemp -d)"
@@ -74,25 +73,25 @@ pack_dir="$(mktemp -d)"
 (cd packages/skill-family-harness-node && pnpm pack --pack-destination "$pack_dir")
 (cd packages/skill-family-engineering-kit && pnpm pack --pack-destination "$pack_dir")
 mkdir "$pack_dir/consumer" && (cd "$pack_dir/consumer" && npm init -y)
-(cd "$pack_dir/consumer" && npm install "$pack_dir/skill-family-contracts-0.24.0.tgz" "$pack_dir/skill-family-harness-node-0.24.0.tgz" "$pack_dir/skill-family-engineering-kit-0.24.0.tgz")
+(cd "$pack_dir/consumer" && npm install "$pack_dir/skill-family-contracts-0.25.0.tgz" "$pack_dir/skill-family-harness-node-0.25.0.tgz" "$pack_dir/skill-family-engineering-kit-0.25.0.tgz")
 ```
 
-After 0.24.0 is formally published, use the registry coordinate:
+The registry installation below requires exact version 0.25.0 to be formally available:
 
 ```sh
-npm install --save-dev skill-family-engineering-kit@0.24.0
-npm exec --package=skill-family-engineering-kit@0.24.0 -- skill-family-kit --help
-npm exec --package=skill-family-engineering-kit@0.24.0 -- skill-family-kit scaffold --root <empty-dir> --project-id my-project
-npm exec --package=skill-family-engineering-kit@0.24.0 -- skill-family-kit adopt-plan --root <repo> --list-capabilities --all --scope all --locale en --uses ./uses.json
-npm exec --package=skill-family-engineering-kit@0.24.0 -- skill-family-kit projection --root <repo>
-npm exec --package=skill-family-engineering-kit@0.24.0 -- skill-family-kit check --root <repo>
+npm install --save-dev skill-family-engineering-kit@0.25.0
+npm exec --package=skill-family-engineering-kit@0.25.0 -- skill-family-kit --help
+npm exec --package=skill-family-engineering-kit@0.25.0 -- skill-family-kit scaffold --root <empty-dir> --project-id my-project
+npm exec --package=skill-family-engineering-kit@0.25.0 -- skill-family-kit adopt-plan --root <repo> --list-capabilities --all --scope all --locale en --uses ./uses.json
+npm exec --package=skill-family-engineering-kit@0.25.0 -- skill-family-kit projection --root <repo>
+npm exec --package=skill-family-engineering-kit@0.25.0 -- skill-family-kit check --root <repo>
 ```
 
-The four commands above cover skeleton generation, read-only inventory, managed projection, and diagnostics respectively; a zero-install form is available via `npm exec --package=skill-family-engineering-kit@0.24.0 -- skill-family-kit --help`.
+The four commands above cover skeleton generation, read-only inventory, managed projection, and diagnostics respectively; a zero-install form is available via `npm exec --package=skill-family-engineering-kit@0.25.0 -- skill-family-kit --help`.
 
-### Engineering declarations in the local 0.24.0 candidate
+### Engineering declarations (available since 0.24.0)
 
-The optional `engineering` input is implemented in the local `0.24.0` candidate. Published `0.23.0` does not support it. Use the already selected SDK only after confirming its actual public interfaces and exact lockstep source for all three Foundation packages; candidate verification and post-release adoption are separate facts. Omitting the input preserves existing bytes and paths. `null`, `{}`, unknown fields, and invalid references are rejected.
+The optional `engineering` input has been available since `0.24.0`; `0.23.0` does not support it. Use the already selected SDK only after confirming its actual public interfaces and exact lockstep source for all three Foundation packages; candidate verification and post-release adoption are separate facts. Omitting the input preserves existing bytes and paths. `null`, `{}`, unknown fields, and invalid references are rejected.
 
 Construct `engineering` from the project's actual business entries and release units. Each `entries` member has `name`, `form`, and `physicalRef`; `form` is either `skill_md` or `file`, and `skill_md` must point to `SKILL.md`. Each `releaseUnits` member has `id` and `versionSource`, with optional `versionMirrors`. A text version reference has `path` and `format: "text"`; a JSON reference has `path`, `format: "json"`, and a non-empty `jsonPointer`. Use actual business version sources, not the private skeleton example package, SDK version, or Profile version. The presence of `package.json` does not establish npm distribution. No separate declaration input file is required.
 
@@ -125,11 +124,11 @@ skill-family-kit projection --root <target> --engineering <JSON>
 
 If facts are incomplete, report the missing facts. A declaration may contain only `entries` or only `releaseUnits`, but the absent declared-check branch remains `incomplete`. Once the real business and version files exist, use the official managed update and the existing core, declared version, and declared entry checks. Generation, a read-only plan, static checks, formal host discovery, real business execution, independent semantic review, and overall qualification remain separate facts. Omission preserves old behavior; it does not mean declarations are complete.
 
-The local 0.24.0 candidate makes a narrow change to `runCoreCheck`: when a target explicitly declares `engineering.releaseUnits`, the core reuses the existing declared reader for `versionSource` and `versionMirrors` (text or JSON), applying the same validation logic. A private `package.json` within the engineering scope is not treated as an implicit source or mirror for that business unit. It is checked for that unit only when explicitly declared. Targets with no version declaration, or only valid `entries`, continue to use the legacy version check. Invalid or duplicate declarations cannot fall back to success. Missing or unreadable declared sources or mirrors fail visibly.
+Since 0.24.0, `runCoreCheck` selects the applicable version-check path from the target declarations: when a target explicitly declares `engineering.releaseUnits`, the core reuses the existing declared reader for `versionSource` and `versionMirrors` (text or JSON), applying the same validation logic. A private `package.json` within the engineering scope is not treated as an implicit source or mirror for that business unit. It is checked for that unit only when explicitly declared. Targets with no version declaration, or only valid `entries`, continue to use the legacy version check. Invalid or duplicate declarations cannot fall back to success. Missing or unreadable declared sources or mirrors fail visibly.
 
 The nine-class loop and report assembly are preserved, maintaining Contracts specification-version compatibility and the integrity of the other eight classes. Declared sources, mirrors, and their ancestral paths are included in the preflight check via the original tree enumeration and `lstat` safety validation, including paths inside opaque tooling directories. Only declared paths are probed; no new directory walker is introduced. Symlinks, FIFOs, and unsafe ancestor paths remain rejected under the original rules, including in-root symlinks. Completion status, mechanism failures, and exit codes 0/1/2 are propagated accurately.
 
-Public `runChecks` defaults to `policy: "legacy"`. Its original findings and full/only equivalence remain unchanged. Explicit `policy: "declared"` still requires `only: "version"` and preserves its report structure, zero-target execution semantics, and zero-Git boundary. No new public policy value, API, CLI option, Schema definition, or package-root export is added. No checker is copied into the generated target shim. The candidate implementation does not establish publication readiness, business qualification, or complete initialization. This update reflects only a narrow, targeted change in core behavior for targets with declared versions; standalone `runChecks` retains its documented behavior.
+Public `runChecks` defaults to `policy: "legacy"`. Its original findings and full/only equivalence remain unchanged. Explicit `policy: "declared"` still requires `only: "version"` and preserves its report structure, zero-target execution semantics, and zero-Git boundary. No new public policy value, API, CLI option, Schema definition, or package-root export is added. No checker is copied into the generated target shim. Local verification does not establish publication readiness, business qualification, or complete initialization. This update reflects only a narrow, targeted change in core behavior for targets with declared versions; standalone `runChecks` retains its documented behavior.
 
 ### Three adoption journeys
 
@@ -180,6 +179,19 @@ npm exec -- skill-family-kit check report --root <repo> --report <report.md> --m
 
 The caller must first construct a valid report model; Kit does not derive facts from open business `outputs`. All fact text is escaped literally, and the full errors of a failed result must appear in both the model and the neutral report.
 
+### Host-loading check sub-action
+
+```sh
+npm exec -- skill-family-kit check host-loading --root <project> --host codex --host-version 0.154.0 --path-category codex-project-skills
+npm exec -- skill-family-kit check host-loading --root <project> --host codex --host-version 0.154.0 --path-category codex-project-skills --activation-rules <relpath.json> --hosts-root <dir>
+```
+
+The public function is `runHostLoadingCheck`. It statically reads `SKILL.md` and the optional Codex 0.154.0 standard skill metadata YAML in `agents/` beside `SKILL.md` under the selected project root `.agents/skills`, and reports format, ignored, filtered, implicit-invocation, disabled, and uncovered observations using the calibrated Codex CLI 0.154.0 rules. Exact optional-file names and parse scope are in [`src/host-loading-check.mjs`](src/host-loading-check.mjs). It does not start a host, model, hook, or script, and writes nothing.
+
+The API `root` must be an absolute project working directory; the CLI resolves the current directory or a relative path to an absolute path first. Only `pathCategory` `codex-project-skills` and version `0.154.0` are calibrated, and that category's relative path must remain `.agents/skills`. Other hosts or versions return exit code 2. A missing skill entry, or a scope that contains only product-filtered targets, returns 1. Callers may pass ordered name/path/enabled rules with `--activation-rules`; without rules, enabled is unknown. Same-name skills at different paths are all retained. Bad optional metadata is ignored as a whole document and is not reported as a skill load failure. `policy.products` that lists only products other than Codex is filtered from the Codex discoverable set; `[codex]` is kept. `allow_implicit_invocation=false` may still be enabled.
+
+A static pass does not prove real install, session selection, or business execution. Consume the published package's public interfaces and sources. This check covers only the selected project's `.agents/skills`. The published package's actual sources are this unit's public closure; that package surface is separate from the check coverage.
+
 ### Candidate Quickstart projection bundle
 
 Use the candidate subpath to build a deterministic Quickstart Profile v2 projection from explicit consumer schemas and frozen source identity:
@@ -271,7 +283,7 @@ The caller owns workload semantics, candidate-to-payload binding, domain asserti
 
   Engineering mode retains the originally verified reference snapshots and rechecks them before each actual mutation and after completion; repeated reads cannot replace the baseline. A rejection before the first write performs no restoration writes, and foreign bytes on an output never attempted by this mode are preserved. If an actual output write is attempted and fails, the existing error, verification, and best-effort rollback path restores only outputs this mode actually attempted. This does not promise a transaction for the whole initialization, hostile concurrency, or ABA safety; the existing v2 complete-closure rollback contract remains unchanged.
 - Ordinary `check` is read-only and has no write calls or `--fix/--apply/--repair` modes (such flags are rejected at the entry point). By default it may spawn one frozen read-only Git status probe; the CLI `--no-git-spawn` (or API `allowGitSpawn: false`) disables that probe. `check relock` is the explicit controlled write transaction; `check qualification` may spawn a bound executable after preflight. Git precondition state uses only filesystem facts plus at most one read-only `git status --porcelain=2` with a frozen parameter vector (`--no-optional-locks` + `GIT_OPTIONAL_LOCKS=0`, no index refresh).
-- In the unreleased declared branch, the two pure check functions remain read-only and do not probe Git. An explicitly requested conclusion is the only added persistent effect and is performed by the two existing wrappers through exclusive creation.
+- In the declared branch, the two pure check functions remain read-only and do not probe Git. An explicitly requested conclusion is the only added persistent effect and is performed by the two existing wrappers through exclusive creation.
 
 ## Error Codes and Exit Codes
 

package/README.zh-CN.md

@@ -5,31 +5,30 @@
 
 # skill-family-engineering-kit
 
-<!-- release-skill:release-version: 0.24.0 -->
+<!-- release-skill:release-version: 0.25.0 -->
 
 开发与 CI 阶段使用的工程工具包。**恰好四个**顶层命令，没有第五个：
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.24.0** (2026-10-07)
+**0.25.0** (2026-10-15)
 
-Engineering Kit 0.24.0 在既有 `check relock` 事务中增加显式的持久工具锁登记能力，四个顶层命令仍为 `scaffold`、`adopt-plan`、`projection`、`check`。本说明记录本地锁步候选状态，不表示远端发布或真实消费者采用已完成。
+Engineering Kit 0.25.0 在既有 `check` 下新增公共函数 `runHostLoadingCheck` 与 CLI 子动作 `skill-family-kit check host-loading`。四个顶层命令仍为 `scaffold`、`adopt-plan`、`projection`、`check`。检查只覆盖 Codex CLI 0.154.0 的项目 `.agents/skills`。未知覆盖返回退出码 2。静态结果不证明安装、会话选择或业务执行。
 
 **变更**
 
-- `registrationClass` 为 API 参数，仅接受 `handwritten` 或 `trackedToolLocks`；CLI 对应参数为 `--registration-class`。默认值保持为 `handwritten`；在默认手写模式下，文件清单为空或缺省时，原自动发现行为维持不变。
-- 使用 `trackedToolLocks` 时必须提供非空显式 `files` 清单，CLI 通过 `--files` 指定。每个路径必须指向目标内已存在的普通文件，不支持自动发现工具锁，也不根据文件名或内容推断工具语义。
-- 若原事务中 `classes.trackedToolLocks` 缺省，则在首次写入前初始化其 `entries` 数组，并追加明确指定的路径；若已有类别非合法对象，或 `entries` 非数组类型，则在首写前拒绝操作。其他类别保持不变。
-- 仅更新 `.foundation/file-registry.json` 与 `skill-family.managed-file-lock.json` 两份状态文件。工具锁内容不进入受管摘要，后续由原工具刷新内容不会因此引发受管漂移；路径、符号链接、已登记路径、状态文档及既有受管漂移的拒绝规则继续有效。中途发布失败时仍暴露原始 `publicationState`，不承诺双文件原子回滚。
-- 包版本与其他三单元同步前移至 0.24.0。Contracts 规格仍为 1.20.0，未新增合同对象、Harness 机制或报告种类；0.23.1 中仅锁步前移的历史说明保持原样。
+- 新增公共函数 `runHostLoadingCheck` 与 CLI `skill-family-kit check host-loading`。API 的 `root` 必须是绝对项目工作目录；CLI 会把当前目录或相对路径先解析成绝对路径。
+- 只校准 `hostId=codex`、`hostVersion=0.154.0`、`pathCategory=codex-project-skills`，且该类别相对路径必须仍是 `.agents/skills`。检查静态读取所选项目根下 `.agents/skills` 的 `SKILL.md`，以及 `SKILL.md` 旁 `agents/` 下 Codex 0.154.0 的可选技能元信息 YAML。不启动宿主、模型、hook 或脚本，不写文件。
+- 其他宿主或版本、未知路径类别返回退出码 2。缺技能入口，或范围内仅有被产品过滤的目标，返回 1。静态通过不证明真实安装、会话选择或业务执行。
+- 包版本与其他三单元锁步到 0.25.0。Contracts 规格仍为 1.20.0。已发布的 0.24.1 能力保持原样，本版本不重做。
 
 **升级说明**
 
-三个 Foundation npm 包须精确锁定至 0.24.0 版本。新登记模式仅属本轮候选，非 0.23.0 已发布能力；实际采用以对应版本公开接口为准。完整消费者、初始化及发布资格仍待验证。
+三个 Foundation npm 包须精确锁定 0.25.0，独立插件与三包保持相同发布版本。Contracts 规格仍为 1.20.0，与 npm 包版本分别处理。消费以实际发布版本的公开接口和源码为准。静态检查通过不证明真实安装、会话选择或业务执行。本说明不替代发布后验证。
 <!-- release-skill:managed:end id=latest-release -->
 
-## 本地未发布治理检查
+## 治理检查（0.22.0）
 
-当前工作树在既有 `check` 命令下增加显式 `declared` 政策。版本检查只读取
+0.22.0 在既有 `check` 命令下增加显式 `declared` 政策。版本检查只读取
 `skill-family.project-manifest.json` 声明的发行单元及其文本或 JSON 版本引用；入口检查只读取
 声明的物理文件。两个分支都不运行目标脚本、Skill、hook、模型，也不先跑未选择的 legacy 检查。
 
@@ -65,7 +64,7 @@ Kit 是「工程阶段」层，依赖 Harness 与 Contracts。它只做四件事
 
 ## 安装和最小示例
 
-0.23.1 是尚未正式发布的本地源码候选；0.23.0 是已发布包。候选验证先把三个包分别打入同一个临时目录，再安装这三个精确 tarball：
+本包版本为 0.25.0；0.24.1 已正式发布。验证尚未正式发布的工作树时，先把三个包分别打入同一个临时目录，再安装这三个精确 tarball：
 
 ```sh
 pack_dir="$(mktemp -d)"
@@ -73,25 +72,25 @@ pack_dir="$(mktemp -d)"
 (cd packages/skill-family-harness-node && pnpm pack --pack-destination "$pack_dir")
 (cd packages/skill-family-engineering-kit && pnpm pack --pack-destination "$pack_dir")
 mkdir "$pack_dir/consumer" && (cd "$pack_dir/consumer" && npm init -y)
-(cd "$pack_dir/consumer" && npm install "$pack_dir/skill-family-contracts-0.23.1.tgz" "$pack_dir/skill-family-harness-node-0.23.1.tgz" "$pack_dir/skill-family-engineering-kit-0.23.1.tgz")
+(cd "$pack_dir/consumer" && npm install "$pack_dir/skill-family-contracts-0.25.0.tgz" "$pack_dir/skill-family-harness-node-0.25.0.tgz" "$pack_dir/skill-family-engineering-kit-0.25.0.tgz")
 ```
 
-0.23.1 正式发布后，再使用对应的 registry 坐标：
+以下 registry 安装方式以精确版本 0.25.0 已正式可用为前提：
 
 ```sh
-npm install --save-dev skill-family-engineering-kit@0.23.1
-npm exec --package=skill-family-engineering-kit@0.23.1 -- skill-family-kit --help
-npm exec --package=skill-family-engineering-kit@0.23.1 -- skill-family-kit scaffold --root <empty-dir> --project-id my-project
-npm exec --package=skill-family-engineering-kit@0.23.1 -- skill-family-kit adopt-plan --root <repo> --list-capabilities --all --scope all --locale zh-CN --uses ./uses.json
-npm exec --package=skill-family-engineering-kit@0.23.1 -- skill-family-kit projection --root <repo>
-npm exec --package=skill-family-engineering-kit@0.23.1 -- skill-family-kit check --root <repo>
+npm install --save-dev skill-family-engineering-kit@0.25.0
+npm exec --package=skill-family-engineering-kit@0.25.0 -- skill-family-kit --help
+npm exec --package=skill-family-engineering-kit@0.25.0 -- skill-family-kit scaffold --root <empty-dir> --project-id my-project
+npm exec --package=skill-family-engineering-kit@0.25.0 -- skill-family-kit adopt-plan --root <repo> --list-capabilities --all --scope all --locale zh-CN --uses ./uses.json
+npm exec --package=skill-family-engineering-kit@0.25.0 -- skill-family-kit projection --root <repo>
+npm exec --package=skill-family-engineering-kit@0.25.0 -- skill-family-kit check --root <repo>
 ```
 
-以上四条命令分别覆盖生成骨架、只读盘点、受管投影与诊断；零安装形式可用 `npm exec --package=skill-family-engineering-kit@0.23.1 -- skill-family-kit --help`。
+以上四条命令分别覆盖生成骨架、只读盘点、受管投影与诊断；零安装形式可用 `npm exec --package=skill-family-engineering-kit@0.25.0 -- skill-family-kit --help`。
 
-### 本地 0.24.0 候选的工程声明调用
+### 工程声明调用（自 0.24.0 提供）
 
-可选 `engineering` 参数已在本地 `0.24.0` 候选中实现，正式 `0.23.0` 不支持。使用已选 SDK 前，核对其实际公共接口与三个 Foundation 包的精确锁步来源；候选验证与正式发布后采用分别报告。省略参数保持既有字节和路径；`null`、`{}`、未知字段和非法引用拒绝。无需另建声明输入文件。
+可选 `engineering` 参数自 `0.24.0` 提供，`0.23.0` 不支持。使用已选 SDK 前，核对其实际公共接口与三个 Foundation 包的精确锁步来源；候选验证与正式发布后采用分别报告。省略参数保持既有字节和路径；`null`、`{}`、未知字段和非法引用拒绝。无需另建声明输入文件。
 
 `engineering` 由调用方依据真实业务入口和发行单元构造。`entries` 每项包含 `name`、`form`、`physicalRef`；`form` 仅为 `skill_md` 或 `file`，前者必须指向 `SKILL.md`。`releaseUnits` 每项包含 `id`、`versionSource`，可选 `versionMirrors`。`versionSource` 为文本或 JSON 引用对象，`versionMirrors` 为引用数组。文本版本引用使用 `path` 和 `format: "text"`；JSON 引用使用 `path`、`format: "json"` 与非空 `jsonPointer`。版本取自真实业务版本源，不取私有骨架示例包、SDK 或 Profile 版本，不因 `package.json` 存在推导 npm 分发。
 
@@ -124,11 +123,11 @@ skill-family-kit projection --root <target> --engineering <JSON>
 
 事实未齐时具体报告缺项。可以只声明 `entries` 或只声明 `releaseUnits`，但未声明的另一检查分支仍为 `incomplete`。待真实业务和版本文件存在后，使用官方受管更新及既有 core、declared 版本、declared 入口检查。生成、只读计划、静态检查、正式宿主发现、真实业务、独立语义审阅与整体资格分别报告；省略参数保留旧行为，不表示声明已完成。
 
-本地 0.24.0 候选对公开 `runCoreCheck` 作一项窄行为修复：目标真实声明 `engineering.releaseUnits` 时，版本类复用已有声明式版本读取逻辑，依据 `versionSource` 与 `versionMirrors` 检查文本或 JSON 格式的版本信息；私有工程的 `package.json` 不自动成为该业务单元的版本源或镜像，仅当被显式声明时方可参与版本认定。对于真正未声明版本、或仅包含合法 `entries` 的目标，仍沿用原有 legacy 版本检查路径。非法或重复的声明不回退为通过；声明的版本源或镜像缺失、不可读时如实失败。
+自 0.24.0 起，公开 `runCoreCheck` 的版本检查按目标声明选择适用路径：目标真实声明 `engineering.releaseUnits` 时，版本类复用已有声明式版本读取逻辑，依据 `versionSource` 与 `versionMirrors` 检查文本或 JSON 格式的版本信息；私有工程的 `package.json` 不自动成为该业务单元的版本源或镜像，仅当被显式声明时方可参与版本认定。对于真正未声明版本、或仅包含合法 `entries` 的目标，仍沿用原有 legacy 版本检查路径。非法或重复的声明不回退为通过；声明的版本源或镜像缺失、不可读时如实失败。
 
 核心调度机制保持不变，共用原九类循环与报告流程，保留 Contracts 规格版本一致性检查及其他八类校验。声明的来源、镜像及各祖先路径均需先通过原树枚举与 `lstat` 安全预检，包括原不展开的工具目录；仅探查声明所涉路径，不引入新的目录遍历器。符号链接、FIFO 及其他不安全读集仍按原规则拒绝访问，禁止穿过根内符号链接目录；`completed`、`mechanism` 与 0/1/2 退出码如实传播。
 
-本次变更仅限于公开 core 在已声明版本目标上的适用性调整：公共 `runChecks` 缺省行为仍等同于显式 `policy: "legacy"`，涵盖原版本发现及 `full`/`only` 等价逻辑；显式 `policy: "declared"` 仍仅允许 `only: "version"`，维持原报告形式、不执行目标代码、不调用 Git 的边界。未新增任何公共 policy 值、API、CLI 参数、Schema 定义或包根导出，亦不在目标生成 shim 中复制检查逻辑。候选实现与局部验证不构成正式发布、业务资格或整体初始化完成的证明。
+该调整仅涉及公开 core 对已声明版本目标的检查：公共 `runChecks` 缺省行为仍等同于显式 `policy: "legacy"`，涵盖原版本发现及 `full`/`only` 等价逻辑；显式 `policy: "declared"` 仍仅允许 `only: "version"`，维持原报告形式、不执行目标代码、不调用 Git 的边界。未新增任何公共 policy 值、API、CLI 参数、Schema 定义或包根导出，亦不在目标生成 shim 中复制检查逻辑。局部验证不构成正式发布、业务资格或整体初始化完成的证明。
 
 ### 三条采用旅程
 
@@ -179,6 +178,19 @@ npm exec -- skill-family-kit check report --root <repo> --report <report.md> --m
 
 调用方必须先构造合法 report model；Kit 不从开放的业务 `outputs` 推导事实。所有事实文本按字面转义，失败结果的完整 errors 必须出现在 model 和中性报告中。
 
+### 宿主加载检查子动作
+
+```sh
+npm exec -- skill-family-kit check host-loading --root <project> --host codex --host-version 0.154.0 --path-category codex-project-skills
+npm exec -- skill-family-kit check host-loading --root <project> --host codex --host-version 0.154.0 --path-category codex-project-skills --activation-rules <relpath.json> --hosts-root <dir>
+```
+
+对应公共函数是 `runHostLoadingCheck`。它只静态读取所选项目根下 `.agents/skills` 的 `SKILL.md`，以及 `SKILL.md` 旁 `agents/` 下 Codex 0.154.0 的标准可选技能元信息 YAML，按 Codex CLI 0.154.0 已校准规则报告格式、忽略、过滤、隐式调用、禁用和未覆盖项。准确文件名与解析范围见 [`src/host-loading-check.mjs`](src/host-loading-check.mjs)。不启动宿主、模型、hook 或脚本，不写文件。
+
+API 的 `root` 必须是绝对项目工作目录；CLI 会把当前目录或相对路径先解析成绝对路径。当前只校准 `pathCategory` 为 `codex-project-skills`、版本 `0.154.0`，且该类别相对路径必须仍是 `.agents/skills`。其他宿主或版本返回退出码 2。缺技能入口，或范围内仅有被产品过滤的目标，返回 1。调用方可用 `--activation-rules` 提供有序 name/path/enabled 规则；缺省时 enabled 未知。同名不同路径都会保留。坏的可选元信息整份忽略，不会被报成技能加载失败。`policy.products` 仅声明 Codex 以外产品时从 Codex 可发现集合过滤，`[codex]` 保留；`allow_implicit_invocation=false` 仍可 enabled。
+
+静态通过不表示真实安装、会话选择或业务执行已经成功。消费以正式发布包的公开接口和源码为准。本次检查覆盖仅所选项目的 `.agents/skills`。发布包的实际来源是本单元公开闭包，与本次检查覆盖范围分别说明。
+
 ### Candidate Quickstart 投影包
 
 需要从显式消费者 Schema 与冻结来源身份生成确定性的 Quickstart Profile v2 投影时，使用 candidate 子路径：
@@ -272,7 +284,7 @@ const stdout = result.streams
 
   工程模式保留原始已核引用快照，在每次实际修改前和完成后重验；重复读取不能替换基线。首写前若发生拒绝，则不执行恢复写入，未尝试输出的外来字节保留。实际尝试写入失败时沿用既有错误、验证与尽力回滚，仅恢复本模式实际尝试的输出路径。不承诺整次初始化事务、恶意并发或 ABA 安全；原 v2 完整闭包回滚合同不变。
 - 普通 `check` 只读且无写调用，也没有 `--fix/--apply/--repair` 模式（此类标志在入口处被拒绝）。默认可能启动一条冻结参数的只读 Git status 探测；CLI 的 `--no-git-spawn`（或 API 的 `allowGitSpawn: false`）可关闭该探测。`check relock` 执行显式受控写事务；`check qualification` 预检通过后可能启动绑定的 executable。Git 前置状态仅用文件系统事实加至多一次冻结参数矢量的只读 `git status --porcelain=2`（`--no-optional-locks` + `GIT_OPTIONAL_LOCKS=0`，不刷新索引）。
-- 未发布的 declared 分支中，两个纯检查函数仍只读，也不探测 Git。只有调用方显式要求结论时，两个既有包装入口才通过独占创建产生本轮唯一新增持久副作用。
+- declared 分支中的两个纯检查函数保持只读，也不探测 Git。只有调用方显式要求结论时，两个既有包装入口才通过独占创建产生本轮唯一新增持久副作用。
 
 ## 错误码与退出码
 

package/data/capability-catalog/capability-catalog.en.json

@@ -1459,6 +1459,54 @@
     "Auto-remediation: the caller"
    ]
   },
+  {
+   "id": "foundation.kit.host-loading-check",
+   "intent": "Statically check whether Skill files under a project .agents/skills tree would load under calibrated Codex CLI 0.154.0 rules",
+   "useWhen": [
+    "Need to inspect project .agents/skills load format, ignored optional metadata, product filtering, implicit invocation, disablement, and uncovered cases before handing Skills to Codex",
+    "Need to reuse Foundation's central calibration instead of launching a real host per family"
+   ],
+   "doNotUseWhen": [
+    "Need to inspect user, system, admin, or ancestor plugin skill roots",
+    "Need to prove real install, session selection, or business execution",
+    "Need to run a target Skill, hook, script, model, or network call"
+   ],
+   "prerequisites": [
+    "Caller supplies an absolute project working directory",
+    "hostId resolves to codex, hostVersion is 0.154.0, and pathCategory is codex-project-skills"
+   ],
+   "inputs": [
+    "Absolute project working directory root",
+    "hostId, hostVersion, and pathCategory",
+    "Optional ordered activationRules (name XOR path plus enabled)"
+   ],
+   "outputs": [
+    "host-loading-check report (kind skill-family.host-loading-check-report)",
+    "Exit 0 means the requested scope completed with no blocking findings; 1 means proven blocking or missing entries; 2 means input, mechanism, or coverage is incomplete"
+   ],
+   "sideEffects": [
+    "None (read-only: no file or temp writes, no process spawn, no network)"
+   ],
+   "failureSemantics": [
+    "Missing discovery root or no SKILL.md returns 1",
+    "Unknown version, unknown pathCategory, illegal selectors, rewritten .agents/skills mapping, directory-symlink mechanism limits, and uncovered interface asset paths return 2",
+    "Bad optional agents/openai.yaml is recorded as ignored for the whole document and does not fail skill loading",
+    "policy.products [chatgpt] is filtered from the Codex discoverable set; [codex] is kept; allow_implicit_invocation=false may still be enabled"
+   ],
+   "invariants": [
+    "Adds no fifth top-level command; it runs as the check host-loading sub-action",
+    "Same-name different paths are all retained",
+    "enabled is unknown when the caller omits activationRules"
+   ],
+   "ownedByCaller": [
+    "Remediation of blocking findings",
+    "Consumer verification on a published package"
+   ],
+   "routeElsewhere": [
+    "Real-host qualification: check qualification",
+    "Foundation entry contract: check entries"
+   ]
+  },
   {
    "id": "foundation.kit.relock",
    "intent": "Run the controlled relock transaction: register new handwritten files by default, or persistent tool-lock paths with explicit trackedToolLocks selection; update the registry and managed-file lock in the existing transaction without hashing tool-lock contents.",

package/data/capability-catalog/capability-catalog.json

@@ -968,6 +968,34 @@
     "packages/skill-family-engineering-kit/test/entry-check.test.mjs"
    ]
   },
+  {
+   "id": "foundation.kit.host-loading-check",
+   "package": "skill-family-engineering-kit",
+   "layer": "engineering-kit",
+   "since": "0.25.0",
+   "stability": "candidate",
+   "migration": "none",
+   "promotionPolicy": "consumer-transparent",
+   "adoptionScopes": ["engineering-kit"],
+   "entrypoints": [
+    "runHostLoadingCheck (packages/skill-family-engineering-kit/src/host-loading-check.mjs)",
+    "checkHostLoadingAction (packages/skill-family-engineering-kit/src/host-loading-check.mjs)",
+    "HOST_LOADING_CHECK_REPORT_KIND (packages/skill-family-engineering-kit/src/host-loading-check.mjs)"
+   ],
+   "sourceRefs": [
+    "packages/skill-family-engineering-kit/src/host-loading-check.mjs",
+    "packages/skill-family-engineering-kit/src/cli.mjs",
+    "packages/skill-family-engineering-kit/src/index.mjs"
+   ],
+   "positiveTestRefs": [
+    "packages/skill-family-engineering-kit/test/host-loading-check.test.mjs",
+    "packages/skill-family-engineering-kit/test/cli.test.mjs"
+   ],
+   "negativeTestRefs": [
+    "packages/skill-family-engineering-kit/test/host-loading-check.test.mjs",
+    "packages/skill-family-engineering-kit/test/cli.test.mjs"
+   ]
+  },
   {
    "id": "foundation.kit.relock",
    "package": "skill-family-engineering-kit",

package/data/capability-catalog/capability-catalog.zh-CN.json

@@ -1458,6 +1458,54 @@
     "自动整改：调用方"
    ]
   },
+  {
+   "id": "foundation.kit.host-loading-check",
+   "intent": "按 Codex CLI 0.154.0 已校准规则，只读检查项目根 .agents/skills 内 Skill 是否会被宿主当作可加载条目",
+   "useWhen": [
+    "需要在把 Skill 交给 Codex 之前核对项目 .agents/skills 的加载格式、忽略、过滤、隐式调用、禁用和未覆盖项",
+    "需要复用 Foundation 集中校准，而不是每个技能族各自启动真实宿主"
+   ],
+   "doNotUseWhen": [
+    "需要检查用户全局、系统、管理员或祖先插件技能根",
+    "需要证明真实安装、会话选择或业务执行已经成功",
+    "需要运行目标 Skill、hook、脚本、模型或联网"
+   ],
+   "prerequisites": [
+    "调用方给出绝对项目工作目录",
+    "hostId 可解析为 codex，hostVersion 为 0.154.0，pathCategory 为 codex-project-skills"
+   ],
+   "inputs": [
+    "绝对项目工作目录 root",
+    "hostId、hostVersion、pathCategory",
+    "可选有序 activationRules（name 或 path 与 enabled）"
+   ],
+   "outputs": [
+    "host-loading-check 报告（kind skill-family.host-loading-check-report）",
+    "退出码 0 表示请求范围完整且无阻断发现；1 表示已证实阻断或缺少入口；2 表示输入、机制或覆盖未完成"
+   ],
+   "sideEffects": [
+    "无（只读：不写文件或临时文件，不启动进程，不联网）"
+   ],
+   "failureSemantics": [
+    "缺发现根或没有 SKILL.md 返回 1",
+    "未知版本、未知 pathCategory、非法选择器、.agents/skills 映射被改写、目录符号链接机制边界、界面资产路径未覆盖返回 2",
+    "坏的可选 agents/openai.yaml 记为 ignored，整份元信息忽略，不作为技能加载失败",
+    "policy.products [chatgpt] 从 Codex 可发现集合过滤；[codex] 保留；allow_implicit_invocation=false 仍可 enabled"
+   ],
+   "invariants": [
+    "不新增第五个顶层命令，落在 check host-loading 子动作",
+    "同名不同路径全部保留",
+    "缺省启用规则时 enabled 未知"
+   ],
+   "ownedByCaller": [
+    "对阻断发现的整改",
+    "正式发布包上的消费者验收"
+   ],
+   "routeElsewhere": [
+    "真实宿主资格：check qualification",
+    "Foundation 入口契约：check entries"
+   ]
+  },
   {
    "id": "foundation.kit.relock",
    "intent": "运行受控 relock 事务：默认登记新增手写文件；显式选择 trackedToolLocks 时登记持久工具锁路径，并在原事务中同步 registry 与受管文件锁。工具锁内容不纳入受管摘要。",

package/docs/agents/capability-catalog.en.json

@@ -1459,6 +1459,54 @@
     "Auto-remediation: the caller"
    ]
   },
+  {
+   "id": "foundation.kit.host-loading-check",
+   "intent": "Statically check whether Skill files under a project .agents/skills tree would load under calibrated Codex CLI 0.154.0 rules",
+   "useWhen": [
+    "Need to inspect project .agents/skills load format, ignored optional metadata, product filtering, implicit invocation, disablement, and uncovered cases before handing Skills to Codex",
+    "Need to reuse Foundation's central calibration instead of launching a real host per family"
+   ],
+   "doNotUseWhen": [
+    "Need to inspect user, system, admin, or ancestor plugin skill roots",
+    "Need to prove real install, session selection, or business execution",
+    "Need to run a target Skill, hook, script, model, or network call"
+   ],
+   "prerequisites": [
+    "Caller supplies an absolute project working directory",
+    "hostId resolves to codex, hostVersion is 0.154.0, and pathCategory is codex-project-skills"
+   ],
+   "inputs": [
+    "Absolute project working directory root",
+    "hostId, hostVersion, and pathCategory",
+    "Optional ordered activationRules (name XOR path plus enabled)"
+   ],
+   "outputs": [
+    "host-loading-check report (kind skill-family.host-loading-check-report)",
+    "Exit 0 means the requested scope completed with no blocking findings; 1 means proven blocking or missing entries; 2 means input, mechanism, or coverage is incomplete"
+   ],
+   "sideEffects": [
+    "None (read-only: no file or temp writes, no process spawn, no network)"
+   ],
+   "failureSemantics": [
+    "Missing discovery root or no SKILL.md returns 1",
+    "Unknown version, unknown pathCategory, illegal selectors, rewritten .agents/skills mapping, directory-symlink mechanism limits, and uncovered interface asset paths return 2",
+    "Bad optional agents/openai.yaml is recorded as ignored for the whole document and does not fail skill loading",
+    "policy.products [chatgpt] is filtered from the Codex discoverable set; [codex] is kept; allow_implicit_invocation=false may still be enabled"
+   ],
+   "invariants": [
+    "Adds no fifth top-level command; it runs as the check host-loading sub-action",
+    "Same-name different paths are all retained",
+    "enabled is unknown when the caller omits activationRules"
+   ],
+   "ownedByCaller": [
+    "Remediation of blocking findings",
+    "Consumer verification on a published package"
+   ],
+   "routeElsewhere": [
+    "Real-host qualification: check qualification",
+    "Foundation entry contract: check entries"
+   ]
+  },
   {
    "id": "foundation.kit.relock",
    "intent": "Run the controlled relock transaction: register new handwritten files by default, or persistent tool-lock paths with explicit trackedToolLocks selection; update the registry and managed-file lock in the existing transaction without hashing tool-lock contents.",

package/docs/agents/capability-catalog.json

@@ -968,6 +968,34 @@
     "packages/skill-family-engineering-kit/test/entry-check.test.mjs"
    ]
   },
+  {
+   "id": "foundation.kit.host-loading-check",
+   "package": "skill-family-engineering-kit",
+   "layer": "engineering-kit",
+   "since": "0.25.0",
+   "stability": "candidate",
+   "migration": "none",
+   "promotionPolicy": "consumer-transparent",
+   "adoptionScopes": ["engineering-kit"],
+   "entrypoints": [
+    "runHostLoadingCheck (packages/skill-family-engineering-kit/src/host-loading-check.mjs)",
+    "checkHostLoadingAction (packages/skill-family-engineering-kit/src/host-loading-check.mjs)",
+    "HOST_LOADING_CHECK_REPORT_KIND (packages/skill-family-engineering-kit/src/host-loading-check.mjs)"
+   ],
+   "sourceRefs": [
+    "packages/skill-family-engineering-kit/src/host-loading-check.mjs",
+    "packages/skill-family-engineering-kit/src/cli.mjs",
+    "packages/skill-family-engineering-kit/src/index.mjs"
+   ],
+   "positiveTestRefs": [
+    "packages/skill-family-engineering-kit/test/host-loading-check.test.mjs",
+    "packages/skill-family-engineering-kit/test/cli.test.mjs"
+   ],
+   "negativeTestRefs": [
+    "packages/skill-family-engineering-kit/test/host-loading-check.test.mjs",
+    "packages/skill-family-engineering-kit/test/cli.test.mjs"
+   ]
+  },
   {
    "id": "foundation.kit.relock",
    "package": "skill-family-engineering-kit",