skill-family-engineering-kit 0.24.1 → 0.25.0

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.25.0 locale=en baseline=sha256:94f4c9be64b930538ffaccf847dadf49baad796b513c142205a18f631d50e66c -->
+## [0.25.0] - 2026-10-15
+
+Engineering Kit 0.25.0 adds the public function `runHostLoadingCheck` and the CLI sub-action `skill-family-kit check host-loading` under the existing `check` command. The four top-level commands remain `scaffold`, `adopt-plan`, `projection`, and `check`. The check covers only Codex CLI 0.154.0 project `.agents/skills`. Unknown coverage returns exit code 2. A static result does not prove install, session selection, or business execution.
+
+### Changed
+
+- Add the public function `runHostLoadingCheck` and the CLI `skill-family-kit check host-loading`. The API `root` must be an absolute project working directory; the CLI resolves the current directory or a relative path to an absolute path first.
+- Only `hostId=codex`, `hostVersion=0.154.0`, and `pathCategory=codex-project-skills` are calibrated, and that category's relative path must remain `.agents/skills`. The check statically reads `SKILL.md` and the optional Codex 0.154.0 skill metadata YAML under `agents/` beside `SKILL.md`. It does not start a host, model, hook, or script, and writes nothing.
+- Other hosts or versions, or an unknown path category, return exit code 2. A missing skill entry, or a scope that contains only product-filtered targets, returns 1. A static pass does not prove real install, session selection, or business execution.
+- The package moves to 0.25.0 with the other three units. Contracts specification remains 1.20.0. Published 0.24.1 capabilities are unchanged and are not redone.
+
+### Upgrade Notes
+
+Pin the three Foundation npm packages to exactly 0.25.0 and keep the independent Plugin at that release version. Contracts specification 1.20.0 remains a separate coordinate from npm package versions. Consume the actual published version's public interfaces and sources. A static check pass does not prove real install, session selection, or business execution. This note does not replace post-publish verification.
+<!-- release-skill:changelog:end version=0.25.0 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.24.1 locale=en baseline=sha256:60780ae0d34a8e8fcc016ebb188586876b9c31ceafb0c02a826db8e449e43729 -->
 ## [0.24.1] - 2026-10-12
 

package/CHANGELOG.zh-CN.md

@@ -1,5 +1,23 @@
 # 变更日志
 
+<!-- release-skill:changelog:start version=0.25.0 locale=zh-CN baseline=sha256:0112af28c40f4ac8dd77173f681345039eb2c55d714315b267827693c5f78e37 -->
+## [0.25.0] - 2026-10-15
+
+Engineering Kit 0.25.0 在既有 `check` 下新增公共函数 `runHostLoadingCheck` 与 CLI 子动作 `skill-family-kit check host-loading`。四个顶层命令仍为 `scaffold`、`adopt-plan`、`projection`、`check`。检查只覆盖 Codex CLI 0.154.0 的项目 `.agents/skills`。未知覆盖返回退出码 2。静态结果不证明安装、会话选择或业务执行。
+
+### 变更
+
+- 新增公共函数 `runHostLoadingCheck` 与 CLI `skill-family-kit check host-loading`。API 的 `root` 必须是绝对项目工作目录；CLI 会把当前目录或相对路径先解析成绝对路径。
+- 只校准 `hostId=codex`、`hostVersion=0.154.0`、`pathCategory=codex-project-skills`，且该类别相对路径必须仍是 `.agents/skills`。检查静态读取所选项目根下 `.agents/skills` 的 `SKILL.md`，以及 `SKILL.md` 旁 `agents/` 下 Codex 0.154.0 的可选技能元信息 YAML。不启动宿主、模型、hook 或脚本，不写文件。
+- 其他宿主或版本、未知路径类别返回退出码 2。缺技能入口，或范围内仅有被产品过滤的目标，返回 1。静态通过不证明真实安装、会话选择或业务执行。
+- 包版本与其他三单元锁步到 0.25.0。Contracts 规格仍为 1.20.0。已发布的 0.24.1 能力保持原样，本版本不重做。
+
+### 升级说明
+
+三个 Foundation npm 包须精确锁定 0.25.0，独立插件与三包保持相同发布版本。Contracts 规格仍为 1.20.0，与 npm 包版本分别处理。消费以实际发布版本的公开接口和源码为准。静态检查通过不证明真实安装、会话选择或业务执行。本说明不替代发布后验证。
+<!-- release-skill:changelog:end version=0.25.0 locale=zh-CN -->
+
+
 <!-- release-skill:changelog:start version=0.24.1 locale=zh-CN baseline=sha256:0d0b6cccd46c69014e89efa21677ef015ccd3085f0fd07e8021b364b1c1f47e6 -->
 ## [0.24.1] - 2026-10-12
 

package/README.md

@@ -4,22 +4,25 @@
 
 # skill-family-engineering-kit
 
-<!-- release-skill:release-version: 0.24.1 -->
+<!-- release-skill:release-version: 0.25.0 -->
 
 An engineering toolkit used in development and CI. There are **exactly four** top-level commands, and no fifth:
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.24.1** (2026-10-12)
+**0.25.0** (2026-10-15)
 
-Engineering Kit 0.24.1 advances only to keep the existing four-unit lockstep contract for the Foundation documentation patch. It adds no capability, API, Schema, protocol, or mechanism.
+Engineering Kit 0.25.0 adds the public function `runHostLoadingCheck` and the CLI sub-action `skill-family-kit check host-loading` under the existing `check` command. The four top-level commands remain `scaffold`, `adopt-plan`, `projection`, and `check`. The check covers only Codex CLI 0.154.0 project `.agents/skills`. Unknown coverage returns exit code 2. A static result does not prove install, session selection, or business execution.
 
 **Changed**
 
-- Update only the package coordinate and its managed version projections; existing capabilities, parameters, and failure boundaries remain unchanged.
+- Add the public function `runHostLoadingCheck` and the CLI `skill-family-kit check host-loading`. The API `root` must be an absolute project working directory; the CLI resolves the current directory or a relative path to an absolute path first.
+- Only `hostId=codex`, `hostVersion=0.154.0`, and `pathCategory=codex-project-skills` are calibrated, and that category's relative path must remain `.agents/skills`. The check statically reads `SKILL.md` and the optional Codex 0.154.0 skill metadata YAML under `agents/` beside `SKILL.md`. It does not start a host, model, hook, or script, and writes nothing.
+- Other hosts or versions, or an unknown path category, return exit code 2. A missing skill entry, or a scope that contains only product-filtered targets, returns 1. A static pass does not prove real install, session selection, or business execution.
+- The package moves to 0.25.0 with the other three units. Contracts specification remains 1.20.0. Published 0.24.1 capabilities are unchanged and are not redone.
 
 **Upgrade Notes**
 
-Pin the three Foundation npm packages to the exact same version and keep the independent Plugin at that release version. Contracts specification 1.20.0 remains a separate coordinate from npm package versions. Use the actual published version's public interfaces and sources; this note does not replace post-publish verification.
+Pin the three Foundation npm packages to exactly 0.25.0 and keep the independent Plugin at that release version. Contracts specification 1.20.0 remains a separate coordinate from npm package versions. Consume the actual published version's public interfaces and sources. A static check pass does not prove real install, session selection, or business execution. This note does not replace post-publish verification.
 <!-- release-skill:managed:end id=latest-release -->
 
 ## Governance Check (0.22.0)
@@ -62,7 +65,7 @@ Kit is the "engineering stage" layer, depending on the Harness and Contracts. It
 
 ## Installation and Minimal Example
 
-This package version is 0.24.1; version 0.24.0 has been formally published. To verify a working tree before formal publication, build all three tarballs into one temporary directory and install those exact files:
+This package version is 0.25.0; version 0.24.1 has been formally published. To verify a working tree before formal publication, build all three tarballs into one temporary directory and install those exact files:
 
 ```sh
 pack_dir="$(mktemp -d)"
@@ -70,21 +73,21 @@ pack_dir="$(mktemp -d)"
 (cd packages/skill-family-harness-node && pnpm pack --pack-destination "$pack_dir")
 (cd packages/skill-family-engineering-kit && pnpm pack --pack-destination "$pack_dir")
 mkdir "$pack_dir/consumer" && (cd "$pack_dir/consumer" && npm init -y)
-(cd "$pack_dir/consumer" && npm install "$pack_dir/skill-family-contracts-0.24.1.tgz" "$pack_dir/skill-family-harness-node-0.24.1.tgz" "$pack_dir/skill-family-engineering-kit-0.24.1.tgz")
+(cd "$pack_dir/consumer" && npm install "$pack_dir/skill-family-contracts-0.25.0.tgz" "$pack_dir/skill-family-harness-node-0.25.0.tgz" "$pack_dir/skill-family-engineering-kit-0.25.0.tgz")
 ```
 
-The registry installation below requires exact version 0.24.1 to be formally available:
+The registry installation below requires exact version 0.25.0 to be formally available:
 
 ```sh
-npm install --save-dev skill-family-engineering-kit@0.24.1
-npm exec --package=skill-family-engineering-kit@0.24.1 -- skill-family-kit --help
-npm exec --package=skill-family-engineering-kit@0.24.1 -- skill-family-kit scaffold --root <empty-dir> --project-id my-project
-npm exec --package=skill-family-engineering-kit@0.24.1 -- skill-family-kit adopt-plan --root <repo> --list-capabilities --all --scope all --locale en --uses ./uses.json
-npm exec --package=skill-family-engineering-kit@0.24.1 -- skill-family-kit projection --root <repo>
-npm exec --package=skill-family-engineering-kit@0.24.1 -- skill-family-kit check --root <repo>
+npm install --save-dev skill-family-engineering-kit@0.25.0
+npm exec --package=skill-family-engineering-kit@0.25.0 -- skill-family-kit --help
+npm exec --package=skill-family-engineering-kit@0.25.0 -- skill-family-kit scaffold --root <empty-dir> --project-id my-project
+npm exec --package=skill-family-engineering-kit@0.25.0 -- skill-family-kit adopt-plan --root <repo> --list-capabilities --all --scope all --locale en --uses ./uses.json
+npm exec --package=skill-family-engineering-kit@0.25.0 -- skill-family-kit projection --root <repo>
+npm exec --package=skill-family-engineering-kit@0.25.0 -- skill-family-kit check --root <repo>
 ```
 
-The four commands above cover skeleton generation, read-only inventory, managed projection, and diagnostics respectively; a zero-install form is available via `npm exec --package=skill-family-engineering-kit@0.24.1 -- skill-family-kit --help`.
+The four commands above cover skeleton generation, read-only inventory, managed projection, and diagnostics respectively; a zero-install form is available via `npm exec --package=skill-family-engineering-kit@0.25.0 -- skill-family-kit --help`.
 
 ### Engineering declarations (available since 0.24.0)
 
@@ -176,6 +179,19 @@ npm exec -- skill-family-kit check report --root <repo> --report <report.md> --m
 
 The caller must first construct a valid report model; Kit does not derive facts from open business `outputs`. All fact text is escaped literally, and the full errors of a failed result must appear in both the model and the neutral report.
 
+### Host-loading check sub-action
+
+```sh
+npm exec -- skill-family-kit check host-loading --root <project> --host codex --host-version 0.154.0 --path-category codex-project-skills
+npm exec -- skill-family-kit check host-loading --root <project> --host codex --host-version 0.154.0 --path-category codex-project-skills --activation-rules <relpath.json> --hosts-root <dir>
+```
+
+The public function is `runHostLoadingCheck`. It statically reads `SKILL.md` and the optional Codex 0.154.0 standard skill metadata YAML in `agents/` beside `SKILL.md` under the selected project root `.agents/skills`, and reports format, ignored, filtered, implicit-invocation, disabled, and uncovered observations using the calibrated Codex CLI 0.154.0 rules. Exact optional-file names and parse scope are in [`src/host-loading-check.mjs`](src/host-loading-check.mjs). It does not start a host, model, hook, or script, and writes nothing.
+
+The API `root` must be an absolute project working directory; the CLI resolves the current directory or a relative path to an absolute path first. Only `pathCategory` `codex-project-skills` and version `0.154.0` are calibrated, and that category's relative path must remain `.agents/skills`. Other hosts or versions return exit code 2. A missing skill entry, or a scope that contains only product-filtered targets, returns 1. Callers may pass ordered name/path/enabled rules with `--activation-rules`; without rules, enabled is unknown. Same-name skills at different paths are all retained. Bad optional metadata is ignored as a whole document and is not reported as a skill load failure. `policy.products` that lists only products other than Codex is filtered from the Codex discoverable set; `[codex]` is kept. `allow_implicit_invocation=false` may still be enabled.
+
+A static pass does not prove real install, session selection, or business execution. Consume the published package's public interfaces and sources. This check covers only the selected project's `.agents/skills`. The published package's actual sources are this unit's public closure; that package surface is separate from the check coverage.
+
 ### Candidate Quickstart projection bundle
 
 Use the candidate subpath to build a deterministic Quickstart Profile v2 projection from explicit consumer schemas and frozen source identity:

package/README.zh-CN.md

@@ -5,22 +5,25 @@
 
 # skill-family-engineering-kit
 
-<!-- release-skill:release-version: 0.24.1 -->
+<!-- release-skill:release-version: 0.25.0 -->
 
 开发与 CI 阶段使用的工程工具包。**恰好四个**顶层命令，没有第五个：
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.24.1** (2026-10-12)
+**0.25.0** (2026-10-15)
 
-Engineering Kit 0.24.1 仅随 Foundation 文档补丁按既有四单元合同锁步前移，没有新增能力、API、Schema、协议或机制。
+Engineering Kit 0.25.0 在既有 `check` 下新增公共函数 `runHostLoadingCheck` 与 CLI 子动作 `skill-family-kit check host-loading`。四个顶层命令仍为 `scaffold`、`adopt-plan`、`projection`、`check`。检查只覆盖 Codex CLI 0.154.0 的项目 `.agents/skills`。未知覆盖返回退出码 2。静态结果不证明安装、会话选择或业务执行。
 
 **变更**
 
-- 仅更新包版本和相应受管版本派生；现有能力、参数与失败边界保持不变。
+- 新增公共函数 `runHostLoadingCheck` 与 CLI `skill-family-kit check host-loading`。API 的 `root` 必须是绝对项目工作目录；CLI 会把当前目录或相对路径先解析成绝对路径。
+- 只校准 `hostId=codex`、`hostVersion=0.154.0`、`pathCategory=codex-project-skills`，且该类别相对路径必须仍是 `.agents/skills`。检查静态读取所选项目根下 `.agents/skills` 的 `SKILL.md`，以及 `SKILL.md` 旁 `agents/` 下 Codex 0.154.0 的可选技能元信息 YAML。不启动宿主、模型、hook 或脚本，不写文件。
+- 其他宿主或版本、未知路径类别返回退出码 2。缺技能入口，或范围内仅有被产品过滤的目标，返回 1。静态通过不证明真实安装、会话选择或业务执行。
+- 包版本与其他三单元锁步到 0.25.0。Contracts 规格仍为 1.20.0。已发布的 0.24.1 能力保持原样，本版本不重做。
 
 **升级说明**
 
-三个 Foundation npm 包须精确锁定同版，独立插件与三包保持相同发布版本。Contracts 规格仍为 1.20.0，与 npm 包版本分别处理；消费以实际发布版本的公开接口和来源为准，本说明不替代发布后验证。
+三个 Foundation npm 包须精确锁定 0.25.0，独立插件与三包保持相同发布版本。Contracts 规格仍为 1.20.0，与 npm 包版本分别处理。消费以实际发布版本的公开接口和源码为准。静态检查通过不证明真实安装、会话选择或业务执行。本说明不替代发布后验证。
 <!-- release-skill:managed:end id=latest-release -->
 
 ## 治理检查（0.22.0）
@@ -61,7 +64,7 @@ Kit 是「工程阶段」层，依赖 Harness 与 Contracts。它只做四件事
 
 ## 安装和最小示例
 
-本包版本为 0.24.1；0.24.0 已正式发布。验证尚未正式发布的工作树时，先把三个包分别打入同一个临时目录，再安装这三个精确 tarball：
+本包版本为 0.25.0；0.24.1 已正式发布。验证尚未正式发布的工作树时，先把三个包分别打入同一个临时目录，再安装这三个精确 tarball：
 
 ```sh
 pack_dir="$(mktemp -d)"
@@ -69,21 +72,21 @@ pack_dir="$(mktemp -d)"
 (cd packages/skill-family-harness-node && pnpm pack --pack-destination "$pack_dir")
 (cd packages/skill-family-engineering-kit && pnpm pack --pack-destination "$pack_dir")
 mkdir "$pack_dir/consumer" && (cd "$pack_dir/consumer" && npm init -y)
-(cd "$pack_dir/consumer" && npm install "$pack_dir/skill-family-contracts-0.24.1.tgz" "$pack_dir/skill-family-harness-node-0.24.1.tgz" "$pack_dir/skill-family-engineering-kit-0.24.1.tgz")
+(cd "$pack_dir/consumer" && npm install "$pack_dir/skill-family-contracts-0.25.0.tgz" "$pack_dir/skill-family-harness-node-0.25.0.tgz" "$pack_dir/skill-family-engineering-kit-0.25.0.tgz")
 ```
 
-以下 registry 安装方式以精确版本 0.24.1 已正式可用为前提：
+以下 registry 安装方式以精确版本 0.25.0 已正式可用为前提：
 
 ```sh
-npm install --save-dev skill-family-engineering-kit@0.24.1
-npm exec --package=skill-family-engineering-kit@0.24.1 -- skill-family-kit --help
-npm exec --package=skill-family-engineering-kit@0.24.1 -- skill-family-kit scaffold --root <empty-dir> --project-id my-project
-npm exec --package=skill-family-engineering-kit@0.24.1 -- skill-family-kit adopt-plan --root <repo> --list-capabilities --all --scope all --locale zh-CN --uses ./uses.json
-npm exec --package=skill-family-engineering-kit@0.24.1 -- skill-family-kit projection --root <repo>
-npm exec --package=skill-family-engineering-kit@0.24.1 -- skill-family-kit check --root <repo>
+npm install --save-dev skill-family-engineering-kit@0.25.0
+npm exec --package=skill-family-engineering-kit@0.25.0 -- skill-family-kit --help
+npm exec --package=skill-family-engineering-kit@0.25.0 -- skill-family-kit scaffold --root <empty-dir> --project-id my-project
+npm exec --package=skill-family-engineering-kit@0.25.0 -- skill-family-kit adopt-plan --root <repo> --list-capabilities --all --scope all --locale zh-CN --uses ./uses.json
+npm exec --package=skill-family-engineering-kit@0.25.0 -- skill-family-kit projection --root <repo>
+npm exec --package=skill-family-engineering-kit@0.25.0 -- skill-family-kit check --root <repo>
 ```
 
-以上四条命令分别覆盖生成骨架、只读盘点、受管投影与诊断；零安装形式可用 `npm exec --package=skill-family-engineering-kit@0.24.1 -- skill-family-kit --help`。
+以上四条命令分别覆盖生成骨架、只读盘点、受管投影与诊断；零安装形式可用 `npm exec --package=skill-family-engineering-kit@0.25.0 -- skill-family-kit --help`。
 
 ### 工程声明调用（自 0.24.0 提供）
 
@@ -175,6 +178,19 @@ npm exec -- skill-family-kit check report --root <repo> --report <report.md> --m
 
 调用方必须先构造合法 report model；Kit 不从开放的业务 `outputs` 推导事实。所有事实文本按字面转义，失败结果的完整 errors 必须出现在 model 和中性报告中。
 
+### 宿主加载检查子动作
+
+```sh
+npm exec -- skill-family-kit check host-loading --root <project> --host codex --host-version 0.154.0 --path-category codex-project-skills
+npm exec -- skill-family-kit check host-loading --root <project> --host codex --host-version 0.154.0 --path-category codex-project-skills --activation-rules <relpath.json> --hosts-root <dir>
+```
+
+对应公共函数是 `runHostLoadingCheck`。它只静态读取所选项目根下 `.agents/skills` 的 `SKILL.md`，以及 `SKILL.md` 旁 `agents/` 下 Codex 0.154.0 的标准可选技能元信息 YAML，按 Codex CLI 0.154.0 已校准规则报告格式、忽略、过滤、隐式调用、禁用和未覆盖项。准确文件名与解析范围见 [`src/host-loading-check.mjs`](src/host-loading-check.mjs)。不启动宿主、模型、hook 或脚本，不写文件。
+
+API 的 `root` 必须是绝对项目工作目录；CLI 会把当前目录或相对路径先解析成绝对路径。当前只校准 `pathCategory` 为 `codex-project-skills`、版本 `0.154.0`，且该类别相对路径必须仍是 `.agents/skills`。其他宿主或版本返回退出码 2。缺技能入口，或范围内仅有被产品过滤的目标，返回 1。调用方可用 `--activation-rules` 提供有序 name/path/enabled 规则；缺省时 enabled 未知。同名不同路径都会保留。坏的可选元信息整份忽略，不会被报成技能加载失败。`policy.products` 仅声明 Codex 以外产品时从 Codex 可发现集合过滤，`[codex]` 保留；`allow_implicit_invocation=false` 仍可 enabled。
+
+静态通过不表示真实安装、会话选择或业务执行已经成功。消费以正式发布包的公开接口和源码为准。本次检查覆盖仅所选项目的 `.agents/skills`。发布包的实际来源是本单元公开闭包，与本次检查覆盖范围分别说明。
+
 ### Candidate Quickstart 投影包
 
 需要从显式消费者 Schema 与冻结来源身份生成确定性的 Quickstart Profile v2 投影时，使用 candidate 子路径：

package/data/capability-catalog/capability-catalog.en.json

@@ -1459,6 +1459,54 @@
     "Auto-remediation: the caller"
    ]
   },
+  {
+   "id": "foundation.kit.host-loading-check",
+   "intent": "Statically check whether Skill files under a project .agents/skills tree would load under calibrated Codex CLI 0.154.0 rules",
+   "useWhen": [
+    "Need to inspect project .agents/skills load format, ignored optional metadata, product filtering, implicit invocation, disablement, and uncovered cases before handing Skills to Codex",
+    "Need to reuse Foundation's central calibration instead of launching a real host per family"
+   ],
+   "doNotUseWhen": [
+    "Need to inspect user, system, admin, or ancestor plugin skill roots",
+    "Need to prove real install, session selection, or business execution",
+    "Need to run a target Skill, hook, script, model, or network call"
+   ],
+   "prerequisites": [
+    "Caller supplies an absolute project working directory",
+    "hostId resolves to codex, hostVersion is 0.154.0, and pathCategory is codex-project-skills"
+   ],
+   "inputs": [
+    "Absolute project working directory root",
+    "hostId, hostVersion, and pathCategory",
+    "Optional ordered activationRules (name XOR path plus enabled)"
+   ],
+   "outputs": [
+    "host-loading-check report (kind skill-family.host-loading-check-report)",
+    "Exit 0 means the requested scope completed with no blocking findings; 1 means proven blocking or missing entries; 2 means input, mechanism, or coverage is incomplete"
+   ],
+   "sideEffects": [
+    "None (read-only: no file or temp writes, no process spawn, no network)"
+   ],
+   "failureSemantics": [
+    "Missing discovery root or no SKILL.md returns 1",
+    "Unknown version, unknown pathCategory, illegal selectors, rewritten .agents/skills mapping, directory-symlink mechanism limits, and uncovered interface asset paths return 2",
+    "Bad optional agents/openai.yaml is recorded as ignored for the whole document and does not fail skill loading",
+    "policy.products [chatgpt] is filtered from the Codex discoverable set; [codex] is kept; allow_implicit_invocation=false may still be enabled"
+   ],
+   "invariants": [
+    "Adds no fifth top-level command; it runs as the check host-loading sub-action",
+    "Same-name different paths are all retained",
+    "enabled is unknown when the caller omits activationRules"
+   ],
+   "ownedByCaller": [
+    "Remediation of blocking findings",
+    "Consumer verification on a published package"
+   ],
+   "routeElsewhere": [
+    "Real-host qualification: check qualification",
+    "Foundation entry contract: check entries"
+   ]
+  },
   {
    "id": "foundation.kit.relock",
    "intent": "Run the controlled relock transaction: register new handwritten files by default, or persistent tool-lock paths with explicit trackedToolLocks selection; update the registry and managed-file lock in the existing transaction without hashing tool-lock contents.",

package/data/capability-catalog/capability-catalog.json

@@ -968,6 +968,34 @@
     "packages/skill-family-engineering-kit/test/entry-check.test.mjs"
    ]
   },
+  {
+   "id": "foundation.kit.host-loading-check",
+   "package": "skill-family-engineering-kit",
+   "layer": "engineering-kit",
+   "since": "0.25.0",
+   "stability": "candidate",
+   "migration": "none",
+   "promotionPolicy": "consumer-transparent",
+   "adoptionScopes": ["engineering-kit"],
+   "entrypoints": [
+    "runHostLoadingCheck (packages/skill-family-engineering-kit/src/host-loading-check.mjs)",
+    "checkHostLoadingAction (packages/skill-family-engineering-kit/src/host-loading-check.mjs)",
+    "HOST_LOADING_CHECK_REPORT_KIND (packages/skill-family-engineering-kit/src/host-loading-check.mjs)"
+   ],
+   "sourceRefs": [
+    "packages/skill-family-engineering-kit/src/host-loading-check.mjs",
+    "packages/skill-family-engineering-kit/src/cli.mjs",
+    "packages/skill-family-engineering-kit/src/index.mjs"
+   ],
+   "positiveTestRefs": [
+    "packages/skill-family-engineering-kit/test/host-loading-check.test.mjs",
+    "packages/skill-family-engineering-kit/test/cli.test.mjs"
+   ],
+   "negativeTestRefs": [
+    "packages/skill-family-engineering-kit/test/host-loading-check.test.mjs",
+    "packages/skill-family-engineering-kit/test/cli.test.mjs"
+   ]
+  },
   {
    "id": "foundation.kit.relock",
    "package": "skill-family-engineering-kit",

package/data/capability-catalog/capability-catalog.zh-CN.json

@@ -1458,6 +1458,54 @@
     "自动整改：调用方"
    ]
   },
+  {
+   "id": "foundation.kit.host-loading-check",
+   "intent": "按 Codex CLI 0.154.0 已校准规则，只读检查项目根 .agents/skills 内 Skill 是否会被宿主当作可加载条目",
+   "useWhen": [
+    "需要在把 Skill 交给 Codex 之前核对项目 .agents/skills 的加载格式、忽略、过滤、隐式调用、禁用和未覆盖项",
+    "需要复用 Foundation 集中校准，而不是每个技能族各自启动真实宿主"
+   ],
+   "doNotUseWhen": [
+    "需要检查用户全局、系统、管理员或祖先插件技能根",
+    "需要证明真实安装、会话选择或业务执行已经成功",
+    "需要运行目标 Skill、hook、脚本、模型或联网"
+   ],
+   "prerequisites": [
+    "调用方给出绝对项目工作目录",
+    "hostId 可解析为 codex，hostVersion 为 0.154.0，pathCategory 为 codex-project-skills"
+   ],
+   "inputs": [
+    "绝对项目工作目录 root",
+    "hostId、hostVersion、pathCategory",
+    "可选有序 activationRules（name 或 path 与 enabled）"
+   ],
+   "outputs": [
+    "host-loading-check 报告（kind skill-family.host-loading-check-report）",
+    "退出码 0 表示请求范围完整且无阻断发现；1 表示已证实阻断或缺少入口；2 表示输入、机制或覆盖未完成"
+   ],
+   "sideEffects": [
+    "无（只读：不写文件或临时文件，不启动进程，不联网）"
+   ],
+   "failureSemantics": [
+    "缺发现根或没有 SKILL.md 返回 1",
+    "未知版本、未知 pathCategory、非法选择器、.agents/skills 映射被改写、目录符号链接机制边界、界面资产路径未覆盖返回 2",
+    "坏的可选 agents/openai.yaml 记为 ignored，整份元信息忽略，不作为技能加载失败",
+    "policy.products [chatgpt] 从 Codex 可发现集合过滤；[codex] 保留；allow_implicit_invocation=false 仍可 enabled"
+   ],
+   "invariants": [
+    "不新增第五个顶层命令，落在 check host-loading 子动作",
+    "同名不同路径全部保留",
+    "缺省启用规则时 enabled 未知"
+   ],
+   "ownedByCaller": [
+    "对阻断发现的整改",
+    "正式发布包上的消费者验收"
+   ],
+   "routeElsewhere": [
+    "真实宿主资格：check qualification",
+    "Foundation 入口契约：check entries"
+   ]
+  },
   {
    "id": "foundation.kit.relock",
    "intent": "运行受控 relock 事务：默认登记新增手写文件；显式选择 trackedToolLocks 时登记持久工具锁路径，并在原事务中同步 registry 与受管文件锁。工具锁内容不纳入受管摘要。",

package/docs/agents/capability-catalog.en.json

@@ -1459,6 +1459,54 @@
     "Auto-remediation: the caller"
    ]
   },
+  {
+   "id": "foundation.kit.host-loading-check",
+   "intent": "Statically check whether Skill files under a project .agents/skills tree would load under calibrated Codex CLI 0.154.0 rules",
+   "useWhen": [
+    "Need to inspect project .agents/skills load format, ignored optional metadata, product filtering, implicit invocation, disablement, and uncovered cases before handing Skills to Codex",
+    "Need to reuse Foundation's central calibration instead of launching a real host per family"
+   ],
+   "doNotUseWhen": [
+    "Need to inspect user, system, admin, or ancestor plugin skill roots",
+    "Need to prove real install, session selection, or business execution",
+    "Need to run a target Skill, hook, script, model, or network call"
+   ],
+   "prerequisites": [
+    "Caller supplies an absolute project working directory",
+    "hostId resolves to codex, hostVersion is 0.154.0, and pathCategory is codex-project-skills"
+   ],
+   "inputs": [
+    "Absolute project working directory root",
+    "hostId, hostVersion, and pathCategory",
+    "Optional ordered activationRules (name XOR path plus enabled)"
+   ],
+   "outputs": [
+    "host-loading-check report (kind skill-family.host-loading-check-report)",
+    "Exit 0 means the requested scope completed with no blocking findings; 1 means proven blocking or missing entries; 2 means input, mechanism, or coverage is incomplete"
+   ],
+   "sideEffects": [
+    "None (read-only: no file or temp writes, no process spawn, no network)"
+   ],
+   "failureSemantics": [
+    "Missing discovery root or no SKILL.md returns 1",
+    "Unknown version, unknown pathCategory, illegal selectors, rewritten .agents/skills mapping, directory-symlink mechanism limits, and uncovered interface asset paths return 2",
+    "Bad optional agents/openai.yaml is recorded as ignored for the whole document and does not fail skill loading",
+    "policy.products [chatgpt] is filtered from the Codex discoverable set; [codex] is kept; allow_implicit_invocation=false may still be enabled"
+   ],
+   "invariants": [
+    "Adds no fifth top-level command; it runs as the check host-loading sub-action",
+    "Same-name different paths are all retained",
+    "enabled is unknown when the caller omits activationRules"
+   ],
+   "ownedByCaller": [
+    "Remediation of blocking findings",
+    "Consumer verification on a published package"
+   ],
+   "routeElsewhere": [
+    "Real-host qualification: check qualification",
+    "Foundation entry contract: check entries"
+   ]
+  },
   {
    "id": "foundation.kit.relock",
    "intent": "Run the controlled relock transaction: register new handwritten files by default, or persistent tool-lock paths with explicit trackedToolLocks selection; update the registry and managed-file lock in the existing transaction without hashing tool-lock contents.",

package/docs/agents/capability-catalog.json

@@ -968,6 +968,34 @@
     "packages/skill-family-engineering-kit/test/entry-check.test.mjs"
    ]
   },
+  {
+   "id": "foundation.kit.host-loading-check",
+   "package": "skill-family-engineering-kit",
+   "layer": "engineering-kit",
+   "since": "0.25.0",
+   "stability": "candidate",
+   "migration": "none",
+   "promotionPolicy": "consumer-transparent",
+   "adoptionScopes": ["engineering-kit"],
+   "entrypoints": [
+    "runHostLoadingCheck (packages/skill-family-engineering-kit/src/host-loading-check.mjs)",
+    "checkHostLoadingAction (packages/skill-family-engineering-kit/src/host-loading-check.mjs)",
+    "HOST_LOADING_CHECK_REPORT_KIND (packages/skill-family-engineering-kit/src/host-loading-check.mjs)"
+   ],
+   "sourceRefs": [
+    "packages/skill-family-engineering-kit/src/host-loading-check.mjs",
+    "packages/skill-family-engineering-kit/src/cli.mjs",
+    "packages/skill-family-engineering-kit/src/index.mjs"
+   ],
+   "positiveTestRefs": [
+    "packages/skill-family-engineering-kit/test/host-loading-check.test.mjs",
+    "packages/skill-family-engineering-kit/test/cli.test.mjs"
+   ],
+   "negativeTestRefs": [
+    "packages/skill-family-engineering-kit/test/host-loading-check.test.mjs",
+    "packages/skill-family-engineering-kit/test/cli.test.mjs"
+   ]
+  },
   {
    "id": "foundation.kit.relock",
    "package": "skill-family-engineering-kit",

package/docs/agents/capability-catalog.zh-CN.json

@@ -1458,6 +1458,54 @@
     "自动整改：调用方"
    ]
   },
+  {
+   "id": "foundation.kit.host-loading-check",
+   "intent": "按 Codex CLI 0.154.0 已校准规则，只读检查项目根 .agents/skills 内 Skill 是否会被宿主当作可加载条目",
+   "useWhen": [
+    "需要在把 Skill 交给 Codex 之前核对项目 .agents/skills 的加载格式、忽略、过滤、隐式调用、禁用和未覆盖项",
+    "需要复用 Foundation 集中校准，而不是每个技能族各自启动真实宿主"
+   ],
+   "doNotUseWhen": [
+    "需要检查用户全局、系统、管理员或祖先插件技能根",
+    "需要证明真实安装、会话选择或业务执行已经成功",
+    "需要运行目标 Skill、hook、脚本、模型或联网"
+   ],
+   "prerequisites": [
+    "调用方给出绝对项目工作目录",
+    "hostId 可解析为 codex，hostVersion 为 0.154.0，pathCategory 为 codex-project-skills"
+   ],
+   "inputs": [
+    "绝对项目工作目录 root",
+    "hostId、hostVersion、pathCategory",
+    "可选有序 activationRules（name 或 path 与 enabled）"
+   ],
+   "outputs": [
+    "host-loading-check 报告（kind skill-family.host-loading-check-report）",
+    "退出码 0 表示请求范围完整且无阻断发现；1 表示已证实阻断或缺少入口；2 表示输入、机制或覆盖未完成"
+   ],
+   "sideEffects": [
+    "无（只读：不写文件或临时文件，不启动进程，不联网）"
+   ],
+   "failureSemantics": [
+    "缺发现根或没有 SKILL.md 返回 1",
+    "未知版本、未知 pathCategory、非法选择器、.agents/skills 映射被改写、目录符号链接机制边界、界面资产路径未覆盖返回 2",
+    "坏的可选 agents/openai.yaml 记为 ignored，整份元信息忽略，不作为技能加载失败",
+    "policy.products [chatgpt] 从 Codex 可发现集合过滤；[codex] 保留；allow_implicit_invocation=false 仍可 enabled"
+   ],
+   "invariants": [
+    "不新增第五个顶层命令，落在 check host-loading 子动作",
+    "同名不同路径全部保留",
+    "缺省启用规则时 enabled 未知"
+   ],
+   "ownedByCaller": [
+    "对阻断发现的整改",
+    "正式发布包上的消费者验收"
+   ],
+   "routeElsewhere": [
+    "真实宿主资格：check qualification",
+    "Foundation 入口契约：check entries"
+   ]
+  },
   {
    "id": "foundation.kit.relock",
    "intent": "运行受控 relock 事务：默认登记新增手写文件；显式选择 trackedToolLocks 时登记持久工具锁路径，并在原事务中同步 registry 与受管文件锁。工具锁内容不纳入受管摘要。",

package/docs/public/status/index.html

@@ -1814,24 +1814,24 @@
 <tbody>
 <tr>
 <td><code>skill-family-contracts</code></td>
-<td>0.24.1</td>
+<td>0.25.0</td>
 <td><a href="https://github.com/ifoohoo/skill-family-contracts">ifoohoo/skill-family-contracts</a></td>
 </tr>
 <tr>
 <td><code>skill-family-harness-node</code></td>
-<td>0.24.1</td>
+<td>0.25.0</td>
 <td><a href="https://github.com/ifoohoo/skill-family-harness-node">ifoohoo/skill-family-harness-node</a></td>
 </tr>
 <tr>
 <td><code>skill-family-engineering-kit</code></td>
-<td>0.24.1</td>
+<td>0.25.0</td>
 <td><a href="https://github.com/ifoohoo/skill-family-engineering-kit">ifoohoo/skill-family-engineering-kit</a></td>
 </tr>
 </tbody>
 </table>
 <h2 id="独立-Plugin">独立 Plugin<a class="headerlink" href="#独立-Plugin" title="Permanent link">&para;</a></h2>
 <ul>
-<li><code>foundation-adoption-review</code>：0.24.1，公开镜像 <a href="https://github.com/ifoohoo/foundation-adoption-review">ifoohoo/foundation-adoption-review</a></li>
+<li><code>foundation-adoption-review</code>：0.25.0，公开镜像 <a href="https://github.com/ifoohoo/foundation-adoption-review">ifoohoo/foundation-adoption-review</a></li>
 <li><code>foundation-adoption-review</code>：只读采用诊断</li>
 <li><code>foundation-engineering-check</code>：只读静态工程审阅与证明读取</li>
 <li><code>foundation-initialize</code>：在明确授权下初始化目标工程，保留业务和人工判断</li>