skill-family-engineering-kit 0.25.0 → 0.27.0

package/CHANGELOG.md

@@ -1,5 +1,45 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.27.0 locale=en baseline=sha256:788200e7009ed97f33b3b4d407854f84ca89240b9a9ee02043413898ba95a66c -->
+## [0.27.0] - 2026-10-21
+
+Engineering Kit 0.27.0 adds the public function `runRegisterExisting` and the CLI sub-action `skill-family-kit check register-existing` under the existing `check` command. The four top-level commands remain `scaffold`, `adopt-plan`, `projection`, and `check`. The sub-action is the only legal first write of `.foundation/file-registry.json`, `skill-family.project-manifest.json`, and `skill-family.managed-file-lock.json` into a nonempty root that already has a valid `profile.json`. Relock never seeds. Scaffold still refuses nonempty directories. Adopt-plan remains read-only. Projection still requires an existing legal registry.
+
+### Changed
+
+- Add the public function `runRegisterExisting` and the CLI `skill-family-kit check register-existing`. The API `root` must be an absolute project working directory; the CLI resolves the current directory or a relative path to an absolute path first. `--handwritten` is required and non-empty.
+- Missing all three closed-world documents yields exclusive create. All three present and byte-identical yields idempotent success with zero write. Any other combination, class overlap, or drifted bytes refuses with zero overwrite.
+- Relock still never seeds a missing registry. Scaffold still refuses nonempty directories. Adopt-plan remains strictly read-only. Projection and later relock still require an existing legal registry.
+- The package moves to 0.27.0 with the other three units. Contracts specification remains 1.20.0. Published 0.26.0 capabilities are unchanged and are not redone.
+
+### Upgrade Notes
+
+Pin the three Foundation npm packages to exactly 0.27.0 and keep the independent Plugin at that release version. Contracts specification 1.20.0 remains a separate coordinate from npm package versions. Consume the actual published version's public interfaces and sources. First nonempty registration does not prove business qualification or completed initialization. This note does not replace post-publish verification.
+<!-- release-skill:changelog:end version=0.27.0 locale=en -->
+
+
+<!-- release-skill:changelog:start version=0.26.0 locale=en baseline=sha256:f92651ad31301672d84ced913199520f2f7868c15881a51766064a9a2b11922c -->
+## [0.26.0] - 2026-10-17
+
+Version 0.26.0 extends shared read-only static loading checks to seven hosts through the existing runHostLoadingCheck function and skill-family-kit check host-loading CLI action. The four top-level commands scaffold, adopt-plan, projection, and check remain unchanged; no new top-level command or public API is added. Checks do not start hosts, models, hooks, or scripts, access the network, or write files.
+
+### Changed
+
+- Add shared static loading checks for seven hosts. The exact host versions, categories, and project directories are listed in the authoritative [NATIVE_HOSTS table](src/host-loading-native.mjs); this internal table is not a package-root public export.
+- Retain Codex CLI 0.154.0 project .agents/skills support and its existing activationRules mechanism.
+- Apply each host’s own discovery, parsing, ignore, name-competition, and local-file flag rules. Report Cursor menu, completion, and model metadata separately.
+- Only modelMetadata.* for Cursor CLI 2026.09.10-fd3934a may use source-reviewed-unexecuted, labeled “源码核实、未作原生运行校准” (source reviewed; not calibrated through native execution). This is not native runtime calibration and does not mean the check starts the host.
+- Other native-observed markers mean the check uses previously calibrated native rules; they do not mean this check starts the host.
+- The API project root must be an absolute working directory; the CLI resolves relative input to an absolute path first. A missing or unbindable project root returns 2. A missing, non-directory, or empty skill container within an existing project returns 1. Proven local loading blockers return 1; specific uncovered behavior or unknown competition returns 2 and takes precedence over 1. A fully covered static scope without blockers returns 0; normal skills cannot mask blockers or uncovered behavior. Only Codex supports activationRules; the seven other hosts accept only omission or null, and any other value, including an empty array, returns 2.
+- Retain link-containment and read boundaries. Uncalibrated actual competition, uncalibrated WorkBuddy optional metadata or version-source forms and icon resolution, Cursor completion string false, and CodeBuddy block scalars without proven equivalence remain specifically uncovered. Do not guess success or return 2 permanently for all ordinary input.
+- Exit 0 proves only static-check success. It does not prove final activation, installation, update, session selection, real triggering, or business execution. Codex evidence cannot establish calibration for other hosts.
+
+### Upgrade Notes
+
+Pin skill-family-engineering-kit, skill-family-contracts, skill-family-harness-node, and the independent Plugin to exactly 0.26.0 in lockstep. Contracts specification 1.20.0 remains separate from package versions and does not advance with Kit. Consume actual published public interfaces for the exact host version and category. Release notes do not replace post-publish verification or formal consumer acceptance. Exit 0 is not an upgrade-safety guarantee or evidence of production validation.
+<!-- release-skill:changelog:end version=0.26.0 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.25.0 locale=en baseline=sha256:94f4c9be64b930538ffaccf847dadf49baad796b513c142205a18f631d50e66c -->
 ## [0.25.0] - 2026-10-15
 

package/CHANGELOG.zh-CN.md

@@ -1,5 +1,45 @@
 # 变更日志
 
+<!-- release-skill:changelog:start version=0.27.0 locale=zh-CN baseline=sha256:1a04833defa7c8007013debe70f397bb051a7cfc4d22a1eac0a11cfe0fe4fe63 -->
+## [0.27.0] - 2026-10-21
+
+Engineering Kit 0.27.0 在既有 `check` 下新增公共函数 `runRegisterExisting` 与 CLI 子动作 `skill-family-kit check register-existing`。四个顶层命令仍为 `scaffold`、`adopt-plan`、`projection`、`check`。该子动作是已有有效 `profile.json` 的非空根首次写入 `.foundation/file-registry.json`、`skill-family.project-manifest.json`、`skill-family.managed-file-lock.json` 的唯一合法入口。`relock` 不为缺锁工程播种。`scaffold` 仍拒绝非空目录。`adopt-plan` 仍只读。`projection` 仍要求已有合法登记。
+
+### 变更
+
+- 新增公共函数 `runRegisterExisting` 与 CLI `skill-family-kit check register-existing`。API 的 `root` 必须是绝对项目工作目录；CLI 会把当前目录或相对路径先解析成绝对路径。`--handwritten` 必填且非空。
+- 三份闭域文件均不存在时排他创建；三份均在且字节一致时幂等成功且零写入；任一其他组合、分类重叠或字节漂移均拒绝且零覆盖。
+- `relock` 仍不为缺锁工程播种。`scaffold` 仍拒绝非空目录。`adopt-plan` 仍严格只读。`projection` 与后续 `relock` 仍要求已有合法登记。
+- 包版本与其他三单元锁步到 0.27.0。Contracts 规格仍为 1.20.0。已发布的 0.26.0 能力保持原样，本版本不重做。
+
+### 升级说明
+
+三个 Foundation npm 包须精确锁定 0.27.0，独立插件与三包保持相同发布版本。Contracts 规格仍为 1.20.0，与 npm 包版本分别处理。消费以实际发布版本的公开接口和源码为准。首次非空登记不证明业务资格或初始化完成。本说明不替代发布后验证。
+<!-- release-skill:changelog:end version=0.27.0 locale=zh-CN -->
+
+
+<!-- release-skill:changelog:start version=0.26.0 locale=zh-CN baseline=sha256:3437859b22ecdad6bc0766dccf3d8b3ed7f1eb9240a9b898f1a2628a092f7143 -->
+## [0.26.0] - 2026-10-17
+
+0.26.0 版本通过既有公共函数 `runHostLoadingCheck` 与 CLI 子动作 `skill-family-kit check host-loading`，扩展对七宿主的共享只读静态加载检查能力。四顶层命令 `scaffold`、`adopt-plan`、`projection`、`check` 保持不变，未新增顶层命令或公共 API。检查不启动宿主、模型、hook 或脚本，不联网、不写文件。
+
+### 变更
+
+- 新增七宿主共享静态加载检查；精确宿主版本、类别与项目目录见权威 [NATIVE_HOSTS 表](src/host-loading-native.mjs)。该内部表不是包根公共导出。
+- **兼容性保留**：Codex CLI 0.154.0 的 `.agents/skills` 项目结构继续支持，其 `activationRules` 机制保持可用。
+- **检查逻辑**：各宿主独立执行发现、解析、忽略、名称竞争与局部文件标志判断。Cursor 的菜单、补全与模型元数据三类行为分别报告。
+- **证据例外**：仅当 `modelMetadata.*` 字段来自 Cursor CLI 2026.09.10-fd3934a 版本时，允许标注 `source-reviewed-unexecuted`，文字为“源码核实、未作原生运行校准”。该标记不表示原生运行已校准，也不代表本次检查启动宿主。
+- **标记语义**：其余 `native-observed` 标记仅表示采用已有原生校准规则，不表示本次检查启动宿主。
+- **边界与退出码**： 项目 root 必须为绝对工作目录，CLI 先将相对输入解析为绝对路径。 项目根不存在或不可绑定 → 退出码 2。 项目存在但技能容器缺失、非目录或为空 → 退出码 1。 已证明本地加载阻断 → 退出码 1。 具体未覆盖或未知竞争 → 退出码 2，且优先于 1。 普通完整静态范围无阻断 → 退出码 0；已有正常技能不能掩盖阻断或未覆盖。 Codex 支持原有 `activationRules`；其余七宿主仅接受省略或 `null`，其他值（包括空数组）返回 2。
+- **数据边界**：保留链接收容与读取边界。未校准的实际竞争、WorkBuddy 尚未校准的可选元信息或版本来源形态及图标解析、Cursor 补全字符串 `false`、CodeBuddy 未证明等价的块标量等，均按具体未覆盖处理，不猜测成功，也不将所有普通输入永久返回 2。
+- **静态通过不等于业务成功**：退出码 0 仅表示静态检查通过，不证明最终启用、安装、更新、会话选择、真实触发或业务执行成功。不得复用 Codex 证据宣称其他宿主已校准。
+
+### 升级说明
+
+三个 Foundation npm 包（`skill-family-engineering-kit`、`skill-family-contracts`、`skill-family-harness-node`）及独立 Plugin 均需精确锁定至 0.26.0 版本，实现四单元锁步。 Contracts 规格保持 1.20.0，与包版本为独立坐标，不随 Kit 升级。 消费方应按精确宿主版本与类别，使用实际已发布的公共接口。 发布说明不替代发布后验证或正式消费者验收。 退出码 0 不构成升级安全保证，不等同于可安全升级或已通过生产验证。
+<!-- release-skill:changelog:end version=0.26.0 locale=zh-CN -->
+
+
 <!-- release-skill:changelog:start version=0.25.0 locale=zh-CN baseline=sha256:0112af28c40f4ac8dd77173f681345039eb2c55d714315b267827693c5f78e37 -->
 ## [0.25.0] - 2026-10-15
 

package/README.md

@@ -4,25 +4,25 @@
 
 # skill-family-engineering-kit
 
-<!-- release-skill:release-version: 0.25.0 -->
+<!-- release-skill:release-version: 0.27.0 -->
 
 An engineering toolkit used in development and CI. There are **exactly four** top-level commands, and no fifth:
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.25.0** (2026-10-15)
+**0.27.0** (2026-10-21)
 
-Engineering Kit 0.25.0 adds the public function `runHostLoadingCheck` and the CLI sub-action `skill-family-kit check host-loading` under the existing `check` command. The four top-level commands remain `scaffold`, `adopt-plan`, `projection`, and `check`. The check covers only Codex CLI 0.154.0 project `.agents/skills`. Unknown coverage returns exit code 2. A static result does not prove install, session selection, or business execution.
+Engineering Kit 0.27.0 adds the public function `runRegisterExisting` and the CLI sub-action `skill-family-kit check register-existing` under the existing `check` command. The four top-level commands remain `scaffold`, `adopt-plan`, `projection`, and `check`. The sub-action is the only legal first write of `.foundation/file-registry.json`, `skill-family.project-manifest.json`, and `skill-family.managed-file-lock.json` into a nonempty root that already has a valid `profile.json`. Relock never seeds. Scaffold still refuses nonempty directories. Adopt-plan remains read-only. Projection still requires an existing legal registry.
 
 **Changed**
 
-- Add the public function `runHostLoadingCheck` and the CLI `skill-family-kit check host-loading`. The API `root` must be an absolute project working directory; the CLI resolves the current directory or a relative path to an absolute path first.
-- Only `hostId=codex`, `hostVersion=0.154.0`, and `pathCategory=codex-project-skills` are calibrated, and that category's relative path must remain `.agents/skills`. The check statically reads `SKILL.md` and the optional Codex 0.154.0 skill metadata YAML under `agents/` beside `SKILL.md`. It does not start a host, model, hook, or script, and writes nothing.
-- Other hosts or versions, or an unknown path category, return exit code 2. A missing skill entry, or a scope that contains only product-filtered targets, returns 1. A static pass does not prove real install, session selection, or business execution.
-- The package moves to 0.25.0 with the other three units. Contracts specification remains 1.20.0. Published 0.24.1 capabilities are unchanged and are not redone.
+- Add the public function `runRegisterExisting` and the CLI `skill-family-kit check register-existing`. The API `root` must be an absolute project working directory; the CLI resolves the current directory or a relative path to an absolute path first. `--handwritten` is required and non-empty.
+- Missing all three closed-world documents yields exclusive create. All three present and byte-identical yields idempotent success with zero write. Any other combination, class overlap, or drifted bytes refuses with zero overwrite.
+- Relock still never seeds a missing registry. Scaffold still refuses nonempty directories. Adopt-plan remains strictly read-only. Projection and later relock still require an existing legal registry.
+- The package moves to 0.27.0 with the other three units. Contracts specification remains 1.20.0. Published 0.26.0 capabilities are unchanged and are not redone.
 
 **Upgrade Notes**
 
-Pin the three Foundation npm packages to exactly 0.25.0 and keep the independent Plugin at that release version. Contracts specification 1.20.0 remains a separate coordinate from npm package versions. Consume the actual published version's public interfaces and sources. A static check pass does not prove real install, session selection, or business execution. This note does not replace post-publish verification.
+Pin the three Foundation npm packages to exactly 0.27.0 and keep the independent Plugin at that release version. Contracts specification 1.20.0 remains a separate coordinate from npm package versions. Consume the actual published version's public interfaces and sources. First nonempty registration does not prove business qualification or completed initialization. This note does not replace post-publish verification.
 <!-- release-skill:managed:end id=latest-release -->
 
 ## Governance Check (0.22.0)
@@ -65,7 +65,7 @@ Kit is the "engineering stage" layer, depending on the Harness and Contracts. It
 
 ## Installation and Minimal Example
 
-This package version is 0.25.0; version 0.24.1 has been formally published. To verify a working tree before formal publication, build all three tarballs into one temporary directory and install those exact files:
+This package version is 0.27.0; version 0.24.1 has been formally published. To verify a working tree before formal publication, build all three tarballs into one temporary directory and install those exact files:
 
 ```sh
 pack_dir="$(mktemp -d)"
@@ -73,21 +73,21 @@ pack_dir="$(mktemp -d)"
 (cd packages/skill-family-harness-node && pnpm pack --pack-destination "$pack_dir")
 (cd packages/skill-family-engineering-kit && pnpm pack --pack-destination "$pack_dir")
 mkdir "$pack_dir/consumer" && (cd "$pack_dir/consumer" && npm init -y)
-(cd "$pack_dir/consumer" && npm install "$pack_dir/skill-family-contracts-0.25.0.tgz" "$pack_dir/skill-family-harness-node-0.25.0.tgz" "$pack_dir/skill-family-engineering-kit-0.25.0.tgz")
+(cd "$pack_dir/consumer" && npm install "$pack_dir/skill-family-contracts-0.27.0.tgz" "$pack_dir/skill-family-harness-node-0.27.0.tgz" "$pack_dir/skill-family-engineering-kit-0.27.0.tgz")
 ```
 
-The registry installation below requires exact version 0.25.0 to be formally available:
+The registry installation below requires exact version 0.27.0 to be formally available:
 
 ```sh
-npm install --save-dev skill-family-engineering-kit@0.25.0
-npm exec --package=skill-family-engineering-kit@0.25.0 -- skill-family-kit --help
-npm exec --package=skill-family-engineering-kit@0.25.0 -- skill-family-kit scaffold --root <empty-dir> --project-id my-project
-npm exec --package=skill-family-engineering-kit@0.25.0 -- skill-family-kit adopt-plan --root <repo> --list-capabilities --all --scope all --locale en --uses ./uses.json
-npm exec --package=skill-family-engineering-kit@0.25.0 -- skill-family-kit projection --root <repo>
-npm exec --package=skill-family-engineering-kit@0.25.0 -- skill-family-kit check --root <repo>
+npm install --save-dev skill-family-engineering-kit@0.27.0
+npm exec --package=skill-family-engineering-kit@0.27.0 -- skill-family-kit --help
+npm exec --package=skill-family-engineering-kit@0.27.0 -- skill-family-kit scaffold --root <empty-dir> --project-id my-project
+npm exec --package=skill-family-engineering-kit@0.27.0 -- skill-family-kit adopt-plan --root <repo> --list-capabilities --all --scope all --locale en --uses ./uses.json
+npm exec --package=skill-family-engineering-kit@0.27.0 -- skill-family-kit projection --root <repo>
+npm exec --package=skill-family-engineering-kit@0.27.0 -- skill-family-kit check --root <repo>
 ```
 
-The four commands above cover skeleton generation, read-only inventory, managed projection, and diagnostics respectively; a zero-install form is available via `npm exec --package=skill-family-engineering-kit@0.25.0 -- skill-family-kit --help`.
+The four commands above cover skeleton generation, read-only inventory, managed projection, and diagnostics respectively; a zero-install form is available via `npm exec --package=skill-family-engineering-kit@0.27.0 -- skill-family-kit --help`.
 
 ### Engineering declarations (available since 0.24.0)
 
@@ -181,16 +181,50 @@ The caller must first construct a valid report model; Kit does not derive facts
 
 ### Host-loading check sub-action
 
+#### Version and scope
+
+Version 0.25.0 provides the Codex CLI 0.154.0 check. The 0.26.0 source candidate extends the same entry to seven additional hosts; formal availability depends on that version's release verification. The 0.25.0 published package does not support the added hosts.
+
+#### Calling the check
+
+The public function is `runHostLoadingCheck({ root, hostId, hostVersion, pathCategory, activationRules, hostsRoot })`. These are the corresponding CLI calls; the third requires a version containing the seven-host extension:
+
 ```sh
 npm exec -- skill-family-kit check host-loading --root <project> --host codex --host-version 0.154.0 --path-category codex-project-skills
 npm exec -- skill-family-kit check host-loading --root <project> --host codex --host-version 0.154.0 --path-category codex-project-skills --activation-rules <relpath.json> --hosts-root <dir>
+npm exec -- skill-family-kit check host-loading --root <project> --host kimi-code --host-version 2.2.0 --path-category kimi-code-project-skills
 ```
 
-The public function is `runHostLoadingCheck`. It statically reads `SKILL.md` and the optional Codex 0.154.0 standard skill metadata YAML in `agents/` beside `SKILL.md` under the selected project root `.agents/skills`, and reports format, ignored, filtered, implicit-invocation, disabled, and uncovered observations using the calibrated Codex CLI 0.154.0 rules. Exact optional-file names and parse scope are in [`src/host-loading-check.mjs`](src/host-loading-check.mjs). It does not start a host, model, hook, or script, and writes nothing.
+The API `root` must be an absolute project directory. The CLI first resolves the current directory or a relative path. `--host`, `--host-version`, and `--path-category` select an exact supported combination. Omitting `hostsRoot` uses the bundled Profile data; a custom root cannot change the calibrated version, category, or relative directory combination.
+
+For Codex, `--activation-rules` takes a project-relative JSON file containing ordered rules. Each rule selects either `name` or `path`, and includes a boolean `enabled`. For the seven added hosts, the API accepts only an omitted or `null` `activationRules`; every non-null value, including `[]`, returns `2`. Omit this CLI option for those hosts.
+
+The internal `NATIVE_HOSTS` table in [src/host-loading-native.mjs](src/host-loading-native.mjs) lists the added hosts' exact versions, categories, and relative directories. It is not a package-root public export. The Kimi example uses `.kimi-code/skills`. Codex keeps its existing constants in [src/host-loading-check.mjs](src/host-loading-check.mjs) and the `.agents/skills` container.
+
+#### Reading the report
+
+The check starts no host, model, hook, or script, makes no network requests, and writes nothing. It covers one explicit project skill container, not the user's global skills, ancestor projects, or the entire plugin environment. Directory and file symlinks in the seven-host extension remain uncovered and return `2`; the check does not read through them.
+
+Codex keeps its existing behavior:
+
+- Same-name skills at different paths are all retained.
+- Invalid optional standard skill metadata YAML under `agents/` beside `SKILL.md` is ignored as a whole document, not reported as a skill load failure.
+- A nonempty `policy.products` containing only products other than Codex is filtered. A list containing `codex` is kept; an empty list does not trigger this filter.
+- `allow_implicit_invocation=false` records implicit invocation being disabled, independently of `enabled`. Without explicit activation rules, `enabled` remains unknown.
+
+For the seven added hosts, each skill's base `enabled`, `disabled`, `implicitInvocation`, `interface`, and `shortDescription` fields remain `null`. Host-specific observations appear in `skills[].observations`, with `field`, `value`, `basis`, and `sourceId`. A `native-observed` basis means that native evidence was used to calibrate the rule; it does not mean this check ran the native host. `sourceId` refers to `coverage.ruleSources`, whose entries contain `id`, `version`, `source`, and `sha256`.
+
+Only Cursor CLI `2026.09.10-fd3934a`'s `modelMetadata.*` observations use `source-reviewed-unexecuted`, meaning source-reviewed but not calibrated by a native run. Its menu and completion surfaces have native calibration evidence. Codex continues to use `officialTag` and `officialCommit`; these fields are not invented for other hosts.
+
+| Exit code | Meaning |
+| --- | --- |
+| `0` | The requested scope is covered and has no established blocker. |
+| `1` | An established blocker, or an existing project with a missing skill container or no discoverable entry. A Codex scope containing only product-filtered targets also returns `1`. |
+| `2` | An unknown version or shape, non-equivalent coverage, invalid selector, or a missing/non-directory project root. |
 
-The API `root` must be an absolute project working directory; the CLI resolves the current directory or a relative path to an absolute path first. Only `pathCategory` `codex-project-skills` and version `0.154.0` are calibrated, and that category's relative path must remain `.agents/skills`. Other hosts or versions return exit code 2. A missing skill entry, or a scope that contains only product-filtered targets, returns 1. Callers may pass ordered name/path/enabled rules with `--activation-rules`; without rules, enabled is unknown. Same-name skills at different paths are all retained. Bad optional metadata is ignored as a whole document and is not reported as a skill load failure. `policy.products` that lists only products other than Codex is filtered from the Codex discoverable set; `[codex]` is kept. `allow_implicit_invocation=false` may still be enabled.
+Uncovered items take precedence and produce `2`, while known `findings` remain in the report. Read `findings`, `uncovered`, and `limitations` together. Name-collision handling follows each host's rules; an uncovered competition does not imply a winner.
 
-A static pass does not prove real install, session selection, or business execution. Consume the published package's public interfaces and sources. This check covers only the selected project's `.agents/skills`. The published package's actual sources are this unit's public closure; that package surface is separate from the check coverage.
+A static `0` does not prove enablement, installation, update, session selection, actual invocation, or business success. The published package's source and public closure are separate from the scope of this check. Use the actual published version's interfaces and sources.
 
 ### Candidate Quickstart projection bundle
 

package/README.zh-CN.md

@@ -5,25 +5,25 @@
 
 # skill-family-engineering-kit
 
-<!-- release-skill:release-version: 0.25.0 -->
+<!-- release-skill:release-version: 0.27.0 -->
 
 开发与 CI 阶段使用的工程工具包。**恰好四个**顶层命令，没有第五个：
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.25.0** (2026-10-15)
+**0.27.0** (2026-10-21)
 
-Engineering Kit 0.25.0 在既有 `check` 下新增公共函数 `runHostLoadingCheck` 与 CLI 子动作 `skill-family-kit check host-loading`。四个顶层命令仍为 `scaffold`、`adopt-plan`、`projection`、`check`。检查只覆盖 Codex CLI 0.154.0 的项目 `.agents/skills`。未知覆盖返回退出码 2。静态结果不证明安装、会话选择或业务执行。
+Engineering Kit 0.27.0 在既有 `check` 下新增公共函数 `runRegisterExisting` 与 CLI 子动作 `skill-family-kit check register-existing`。四个顶层命令仍为 `scaffold`、`adopt-plan`、`projection`、`check`。该子动作是已有有效 `profile.json` 的非空根首次写入 `.foundation/file-registry.json`、`skill-family.project-manifest.json`、`skill-family.managed-file-lock.json` 的唯一合法入口。`relock` 不为缺锁工程播种。`scaffold` 仍拒绝非空目录。`adopt-plan` 仍只读。`projection` 仍要求已有合法登记。
 
 **变更**
 
-- 新增公共函数 `runHostLoadingCheck` 与 CLI `skill-family-kit check host-loading`。API 的 `root` 必须是绝对项目工作目录；CLI 会把当前目录或相对路径先解析成绝对路径。
-- 只校准 `hostId=codex`、`hostVersion=0.154.0`、`pathCategory=codex-project-skills`，且该类别相对路径必须仍是 `.agents/skills`。检查静态读取所选项目根下 `.agents/skills` 的 `SKILL.md`，以及 `SKILL.md` 旁 `agents/` 下 Codex 0.154.0 的可选技能元信息 YAML。不启动宿主、模型、hook 或脚本，不写文件。
-- 其他宿主或版本、未知路径类别返回退出码 2。缺技能入口，或范围内仅有被产品过滤的目标，返回 1。静态通过不证明真实安装、会话选择或业务执行。
-- 包版本与其他三单元锁步到 0.25.0。Contracts 规格仍为 1.20.0。已发布的 0.24.1 能力保持原样，本版本不重做。
+- 新增公共函数 `runRegisterExisting` 与 CLI `skill-family-kit check register-existing`。API 的 `root` 必须是绝对项目工作目录；CLI 会把当前目录或相对路径先解析成绝对路径。`--handwritten` 必填且非空。
+- 三份闭域文件均不存在时排他创建；三份均在且字节一致时幂等成功且零写入；任一其他组合、分类重叠或字节漂移均拒绝且零覆盖。
+- `relock` 仍不为缺锁工程播种。`scaffold` 仍拒绝非空目录。`adopt-plan` 仍严格只读。`projection` 与后续 `relock` 仍要求已有合法登记。
+- 包版本与其他三单元锁步到 0.27.0。Contracts 规格仍为 1.20.0。已发布的 0.26.0 能力保持原样，本版本不重做。
 
 **升级说明**
 
-三个 Foundation npm 包须精确锁定 0.25.0，独立插件与三包保持相同发布版本。Contracts 规格仍为 1.20.0，与 npm 包版本分别处理。消费以实际发布版本的公开接口和源码为准。静态检查通过不证明真实安装、会话选择或业务执行。本说明不替代发布后验证。
+三个 Foundation npm 包须精确锁定 0.27.0，独立插件与三包保持相同发布版本。Contracts 规格仍为 1.20.0，与 npm 包版本分别处理。消费以实际发布版本的公开接口和源码为准。首次非空登记不证明业务资格或初始化完成。本说明不替代发布后验证。
 <!-- release-skill:managed:end id=latest-release -->
 
 ## 治理检查（0.22.0）
@@ -64,7 +64,7 @@ Kit 是「工程阶段」层，依赖 Harness 与 Contracts。它只做四件事
 
 ## 安装和最小示例
 
-本包版本为 0.25.0；0.24.1 已正式发布。验证尚未正式发布的工作树时，先把三个包分别打入同一个临时目录，再安装这三个精确 tarball：
+本包版本为 0.27.0；0.24.1 已正式发布。验证尚未正式发布的工作树时，先把三个包分别打入同一个临时目录，再安装这三个精确 tarball：
 
 ```sh
 pack_dir="$(mktemp -d)"
@@ -72,21 +72,21 @@ pack_dir="$(mktemp -d)"
 (cd packages/skill-family-harness-node && pnpm pack --pack-destination "$pack_dir")
 (cd packages/skill-family-engineering-kit && pnpm pack --pack-destination "$pack_dir")
 mkdir "$pack_dir/consumer" && (cd "$pack_dir/consumer" && npm init -y)
-(cd "$pack_dir/consumer" && npm install "$pack_dir/skill-family-contracts-0.25.0.tgz" "$pack_dir/skill-family-harness-node-0.25.0.tgz" "$pack_dir/skill-family-engineering-kit-0.25.0.tgz")
+(cd "$pack_dir/consumer" && npm install "$pack_dir/skill-family-contracts-0.27.0.tgz" "$pack_dir/skill-family-harness-node-0.27.0.tgz" "$pack_dir/skill-family-engineering-kit-0.27.0.tgz")
 ```
 
-以下 registry 安装方式以精确版本 0.25.0 已正式可用为前提：
+以下 registry 安装方式以精确版本 0.27.0 已正式可用为前提：
 
 ```sh
-npm install --save-dev skill-family-engineering-kit@0.25.0
-npm exec --package=skill-family-engineering-kit@0.25.0 -- skill-family-kit --help
-npm exec --package=skill-family-engineering-kit@0.25.0 -- skill-family-kit scaffold --root <empty-dir> --project-id my-project
-npm exec --package=skill-family-engineering-kit@0.25.0 -- skill-family-kit adopt-plan --root <repo> --list-capabilities --all --scope all --locale zh-CN --uses ./uses.json
-npm exec --package=skill-family-engineering-kit@0.25.0 -- skill-family-kit projection --root <repo>
-npm exec --package=skill-family-engineering-kit@0.25.0 -- skill-family-kit check --root <repo>
+npm install --save-dev skill-family-engineering-kit@0.27.0
+npm exec --package=skill-family-engineering-kit@0.27.0 -- skill-family-kit --help
+npm exec --package=skill-family-engineering-kit@0.27.0 -- skill-family-kit scaffold --root <empty-dir> --project-id my-project
+npm exec --package=skill-family-engineering-kit@0.27.0 -- skill-family-kit adopt-plan --root <repo> --list-capabilities --all --scope all --locale zh-CN --uses ./uses.json
+npm exec --package=skill-family-engineering-kit@0.27.0 -- skill-family-kit projection --root <repo>
+npm exec --package=skill-family-engineering-kit@0.27.0 -- skill-family-kit check --root <repo>
 ```
 
-以上四条命令分别覆盖生成骨架、只读盘点、受管投影与诊断；零安装形式可用 `npm exec --package=skill-family-engineering-kit@0.25.0 -- skill-family-kit --help`。
+以上四条命令分别覆盖生成骨架、只读盘点、受管投影与诊断；零安装形式可用 `npm exec --package=skill-family-engineering-kit@0.27.0 -- skill-family-kit --help`。
 
 ### 工程声明调用（自 0.24.0 提供）
 
@@ -180,16 +180,89 @@ npm exec -- skill-family-kit check report --root <repo> --report <report.md> --m
 
 ### 宿主加载检查子动作
 
+#### 版本边界与能力范围
+
+- **0.25.0** 版本已支持对 Codex 0.154.0 的宿主加载检查。
+- **0.26.0** 源码候选版本在相同入口中新增对七宿主的检查能力，但该功能**仍处于候选状态**，正式可用性需以该版本的实际发布验证为准。**请勿使用 0.25.0 发布包运行新增宿主检查**。
+
+#### CLI 命令与参数说明
+
+公共函数为 `runHostLoadingCheck({ root, hostId, hostVersion, pathCategory, activationRules, hostsRoot })`。以下是对应 CLI 调用；第三条需要包含七宿主增量的版本：
+
 ```sh
 npm exec -- skill-family-kit check host-loading --root <project> --host codex --host-version 0.154.0 --path-category codex-project-skills
 npm exec -- skill-family-kit check host-loading --root <project> --host codex --host-version 0.154.0 --path-category codex-project-skills --activation-rules <relpath.json> --hosts-root <dir>
+npm exec -- skill-family-kit check host-loading --root <project> --host kimi-code --host-version 2.2.0 --path-category kimi-code-project-skills
 ```
 
-对应公共函数是 `runHostLoadingCheck`。它只静态读取所选项目根下 `.agents/skills` 的 `SKILL.md`，以及 `SKILL.md` 旁 `agents/` 下 Codex 0.154.0 的标准可选技能元信息 YAML，按 Codex CLI 0.154.0 已校准规则报告格式、忽略、过滤、隐式调用、禁用和未覆盖项。准确文件名与解析范围见 [`src/host-loading-check.mjs`](src/host-loading-check.mjs)。不启动宿主、模型、hook 或脚本，不写文件。
+- `root`：必须为绝对项目目录路径；CLI 会先解析当前目录或相对路径。
+- `host`：宿主标识符，如 `codex` 或 `kimi-code`。
+- `host-version`：对应宿主版本号，如 `0.154.0` 或 `2.2.0`。
+- `path-category`：宿主技能容器的相对目录类别，例如 `codex-project-skills` 或 `kimi-code-project-skills`。
+- `--activation-rules`：CLI 接收项目根内相对 JSON 文件路径，其内容为有序规则数组，每项选择 `name` 或 `path` 之一，并带 `enabled` 布尔值。只有 Codex 支持这些规则。新增七宿主的 API 参数 `activationRules` 仅允许省略或 `null`，包括 `[]` 在内的任何非 `null` 值都返回 `2`；CLI 应省略该选项。
+- `hosts-root`：可选，指定自定义宿主配置根目录；省略时使用包内默认 Profile。**指定后不得修改已校准的精确版本、类别与相对目录组合**。
+
+#### 宿主选择器与实现依据
+
+新增七宿主的精确选择器定义于公开源码中：
+
+[src/host-loading-native.mjs](src/host-loading-native.mjs) 中的 `NATIVE_HOSTS` 内部表。
+
+该表为内部实现结构，不是包根公共导出；它列出新增七宿主支持的精确版本、类别与相对目录组合。Kimi 示例使用 `.kimi-code/skills`。
+
+Codex 的选择器仍沿用 [src/host-loading-check.mjs](src/host-loading-check.mjs) 中的常量合同，容器为 `.agents/skills`。
+
+#### 检查行为与限制
+
+- **不启动宿主、模型、hook 或脚本**。
+- **不联网、不写入文件、不修改任何状态**。
+- **仅静态分析项目容器内指定路径下的技能结构**。
+- **检查范围不涵盖用户全局技能、祖先项目或插件全环境**。
+- **新增七宿主的目录或文件符号链接保留为未覆盖，返回退出码 2，不越界读取**。
+- **仅检查一个显式指定的项目容器**，不推断启用、安装、更新、会话选择或真实业务触发的成功性。
+
+#### Codex 保留行为
+
+- 同名不同路径的技能全部保留，不合并或覆盖。
+- `SKILL.md` 旁 `agents/` 目录下的标准可选技能元信息 YAML，若存在错误则整份忽略，不导致加载失败。
+- `policy.products` 非空且只列出 Codex 以外产品时才过滤；包含 `codex` 时保留，空列表不触发产品过滤。
+- `allow_implicit_invocation=false` 记录隐式调用关闭，不代表 `enabled=false`；缺少显式启用规则时，`enabled` 仍未知。
+- `activationRules` 仅 Codex 支持传入有序数组，每项为 `name` 或 `path` 二选一，加 `enabled` 布尔值。
+
+#### 新增七宿主行为
+
+- 所有技能的基础字段 `enabled`、`disabled`、`implicitInvocation`、`interface`、`shortDescription` 均为 `null`。
+- 原生行为差异通过 `skills[].observations` 数组表达，每项包含：
+  - `field`：被观察的字段名
+  - `value`：观察到的值
+  - `basis`：观察依据，`native-observed` 表示该规则曾用原生事实校准，不表示本次检查启动过宿主
+  - `sourceId`：来源标识，对应 `coverage.ruleSources` 中的记录
+- `coverage.ruleSources` 记录每条规则的：
+  - `id`
+  - `version`
+  - `source`
+  - `sha256`
+- **仅 Cursor CLI 版本 `2026.09.10-fd3934a` 的 `modelMetadata.*` 字段标记为 `source-reviewed-unexecuted`**，表示“源码核实、未作原生运行校准”。
+- Cursor 的菜单与补全面已有原生校准，**不能将此例外推广为整个宿主无原生证据**。
+- Codex 继续使用 `officialTag` 和 `officialCommit`，**不虚构给其他宿主**。
+
+#### 退出码与结果解读
+
+| 退出码 | 含义 |
+|--------|------|
+| `0` | 请求范围完整，且无已证实阻断 |
+| `1` | 存在已证实阻断，或项目存在但缺技能容器、没有可发现入口；Codex 只有被产品过滤的目标也返回 `1` |
+| `2` | 未知版本/形态、非等价覆盖、非法选择器，或项目根不存在/非目录 |
+
+- **有未覆盖项时优先返回 2，但不丢弃已知的 `findings`**。
+- **报告需综合 `findings`、`uncovered`、`limitations` 三部分，不可仅依赖退出码判断**。
+- **同名规则按宿主独立处理，未覆盖时不猜胜者**。
+
+#### 重要说明
 
-API 的 `root` 必须是绝对项目工作目录；CLI 会把当前目录或相对路径先解析成绝对路径。当前只校准 `pathCategory` 为 `codex-project-skills`、版本 `0.154.0`，且该类别相对路径必须仍是 `.agents/skills`。其他宿主或版本返回退出码 2。缺技能入口，或范围内仅有被产品过滤的目标，返回 1。调用方可用 `--activation-rules` 提供有序 name/path/enabled 规则；缺省时 enabled 未知。同名不同路径都会保留。坏的可选元信息整份忽略，不会被报成技能加载失败。`policy.products` 仅声明 Codex 以外产品时从 Codex 可发现集合过滤，`[codex]` 保留；`allow_implicit_invocation=false` 仍可 enabled。
+- 本检查为静态分析，**不证明宿主已启用、已安装、已更新、会话中被选择或业务流程成功**。
+- 发布包来源与检查范围是两个独立判断，消费正式包时需依据实际接口与来源。
 
-静态通过不表示真实安装、会话选择或业务执行已经成功。消费以正式发布包的公开接口和源码为准。本次检查覆盖仅所选项目的 `.agents/skills`。发布包的实际来源是本单元公开闭包，与本次检查覆盖范围分别说明。
 
 ### Candidate Quickstart 投影包
 

package/data/capability-catalog/capability-catalog.en.json

@@ -1507,6 +1507,57 @@
     "Foundation entry contract: check entries"
    ]
   },
+  {
+   "id": "foundation.kit.register-existing",
+   "intent": "Seed the three official closed-world documents for a nonempty project that already has a valid profile.json and does not yet have a legal registry",
+   "useWhen": [
+    "Need the only legal first write of .foundation/file-registry.json, skill-family.project-manifest.json, and skill-family.managed-file-lock.json into a nonempty root",
+    "Need an official first-nonempty registration that is exclusive-create, idempotent on identical bytes, and refuse-with-zero-overwrite otherwise"
+   ],
+   "doNotUseWhen": [
+    "The target is empty (use scaffold)",
+    "The three official documents already exist and a later handwritten file must be admitted (use check relock)",
+    "Need a read-only inventory of an existing project (use adopt-plan)",
+    "Need to overwrite drifted closed-world bytes"
+   ],
+   "prerequisites": [
+    "Caller supplies an absolute project working directory",
+    "profile.json exists at the target root and is contract-valid, including profile.adoption.foundation_profile.id",
+    "handwritten classification list is non-empty"
+   ],
+   "inputs": [
+    "Absolute project working directory root",
+    "Non-empty handwritten globs or relative paths",
+    "Optional engineering JSON, trackedToolLocks paths, and gitignore-style artifacts patterns"
+   ],
+   "outputs": [
+    "register-existing report (kind skill-family.register-existing-report)",
+    "On first create: exclusive publication of the three closed-world documents; on identical bytes: idempotent success with zero write; otherwise refuse with zero overwrite"
+   ],
+   "sideEffects": [
+    "Writes at most the three closed-world documents; never overwrites mismatched existing bytes; does not scaffold, apply adopt-plan, or seed via relock"
+   ],
+   "failureSemantics": [
+    "Missing or invalid profile.json refuses",
+    "Empty handwritten list refuses",
+    "Class overlap among handwritten, artifacts, and trackedToolLocks refuses",
+    "Any incomplete or drifted combination of the three documents refuses with zero overwrite"
+   ],
+   "invariants": [
+    "Adds no fifth top-level command; it runs as the check register-existing sub-action",
+    "Relock never seeds; this sub-action is the only legal first write of the three documents into a nonempty root",
+    "Scaffold still refuses nonempty directories; adopt-plan remains read-only"
+   ],
+   "ownedByCaller": [
+    "Choosing handwritten, artifacts, and trackedToolLocks classifications",
+    "Remediation after a refuse-with-zero-overwrite result"
+   ],
+   "routeElsewhere": [
+    "Empty target: scaffold",
+    "Existing legal registry plus new handwritten files: check relock",
+    "Read-only nonempty inventory: adopt-plan"
+   ]
+  },
   {
    "id": "foundation.kit.relock",
    "intent": "Run the controlled relock transaction: register new handwritten files by default, or persistent tool-lock paths with explicit trackedToolLocks selection; update the registry and managed-file lock in the existing transaction without hashing tool-lock contents.",

package/data/capability-catalog/capability-catalog.json

@@ -996,6 +996,32 @@
     "packages/skill-family-engineering-kit/test/cli.test.mjs"
    ]
   },
+  {
+   "id": "foundation.kit.register-existing",
+   "package": "skill-family-engineering-kit",
+   "layer": "engineering-kit",
+   "since": "0.27.0",
+   "stability": "candidate",
+   "migration": "none",
+   "promotionPolicy": "consumer-transparent",
+   "adoptionScopes": ["engineering-kit"],
+   "entrypoints": [
+    "runRegisterExisting (packages/skill-family-engineering-kit/src/register-existing.mjs)",
+    "registerExistingAction (packages/skill-family-engineering-kit/src/register-existing.mjs)",
+    "REGISTER_EXISTING_REPORT_KIND (packages/skill-family-engineering-kit/src/register-existing.mjs)"
+   ],
+   "sourceRefs": [
+    "packages/skill-family-engineering-kit/src/register-existing.mjs",
+    "packages/skill-family-engineering-kit/src/cli.mjs",
+    "packages/skill-family-engineering-kit/src/index.mjs"
+   ],
+   "positiveTestRefs": [
+    "packages/skill-family-engineering-kit/test/register-existing.test.mjs"
+   ],
+   "negativeTestRefs": [
+    "packages/skill-family-engineering-kit/test/register-existing.test.mjs"
+   ]
+  },
   {
    "id": "foundation.kit.relock",
    "package": "skill-family-engineering-kit",

package/data/capability-catalog/capability-catalog.zh-CN.json

@@ -1506,6 +1506,57 @@
     "Foundation 入口契约：check entries"
    ]
   },
+  {
+   "id": "foundation.kit.register-existing",
+   "intent": "为已有有效 profile.json、尚未具备合法登记的非空工程，播种三份官方闭域文件",
+   "useWhen": [
+    "需要把 .foundation/file-registry.json、skill-family.project-manifest.json、skill-family.managed-file-lock.json 合法地首次写入非空根",
+    "需要官方首次非空登记：三份皆无则排他创建，字节一致则幂等零写入，其余情况拒绝且零覆盖"
+   ],
+   "doNotUseWhen": [
+    "目标为空（走 scaffold）",
+    "三份官方文件已存在、只需纳入后来的手写文件（走 check relock）",
+    "只需只读盘点既有工程（走 adopt-plan）",
+    "需要覆盖已漂移的闭域字节"
+   ],
+   "prerequisites": [
+    "调用方给出绝对项目工作目录",
+    "目标根已有合同有效的 profile.json，且含 profile.adoption.foundation_profile.id",
+    "手写分类清单非空"
+   ],
+   "inputs": [
+    "绝对项目工作目录 root",
+    "非空手写 glob 或相对路径",
+    "可选 engineering JSON、trackedToolLocks 路径，以及 gitignore 风格的 artifacts 模式"
+   ],
+   "outputs": [
+    "register-existing 报告（kind skill-family.register-existing-report）",
+    "首次创建时排他写入三份闭域文件；字节一致时幂等成功且零写入；否则拒绝且零覆盖"
+   ],
+   "sideEffects": [
+    "最多写入三份闭域文件；从不覆盖不匹配的既有字节；不 scaffold、不 apply adopt-plan、不经 relock 播种"
+   ],
+   "failureSemantics": [
+    "缺少或无效的 profile.json 拒绝",
+    "空手写清单拒绝",
+    "handwritten、artifacts、trackedToolLocks 分类重叠拒绝",
+    "三份文件任一不完整或字节漂移时拒绝且零覆盖"
+   ],
+   "invariants": [
+    "不新增第五个顶层命令，落在 check register-existing 子动作",
+    "relock 不为缺锁工程播种；本子动作是非空根首次写入三份文件的唯一合法入口",
+    "scaffold 仍拒绝非空目录；adopt-plan 仍只读"
+   ],
+   "ownedByCaller": [
+    "选择 handwritten、artifacts、trackedToolLocks 分类",
+    "拒绝且零覆盖之后的整改"
+   ],
+   "routeElsewhere": [
+    "空目标：scaffold",
+    "已有合法登记且需纳入新手写文件：check relock",
+    "非空只读盘点：adopt-plan"
+   ]
+  },
   {
    "id": "foundation.kit.relock",
    "intent": "运行受控 relock 事务：默认登记新增手写文件；显式选择 trackedToolLocks 时登记持久工具锁路径，并在原事务中同步 registry 与受管文件锁。工具锁内容不纳入受管摘要。",

package/data/hosts/codebuddy/host-descriptor.json

@@ -11,7 +11,15 @@
     "credentialMutation": "host-managed"
   },
   "sourceAliases": [],
-  "pathCategories": [],
+  "pathCategories": [
+    {
+      "id": "codebuddy-project-skills",
+      "role": "skill-root",
+      "scope": "project",
+      "anchor": "project-root",
+      "relPath": ".codebuddy/skills"
+    }
+  ],
   "probeCapabilities": [
     "cli",
     "version",

package/data/hosts/deepseek-harness/host-descriptor.json

@@ -8,7 +8,15 @@
   "sourceAliases": [
     "dsh"
   ],
-  "pathCategories": [],
+  "pathCategories": [
+    {
+      "id": "deepseek-harness-project-skills",
+      "role": "skill-root",
+      "scope": "project",
+      "anchor": "project-root",
+      "relPath": ".dsh/skills"
+    }
+  ],
   "probeCapabilities": [
     "cli",
     "version",

package/data/hosts/kimi-code/host-descriptor.json

@@ -20,6 +20,13 @@
       "scope": "project",
       "anchor": "project-root",
       "relPath": "skills"
+    },
+    {
+      "id": "kimi-code-project-skills",
+      "role": "skill-root",
+      "scope": "project",
+      "anchor": "project-root",
+      "relPath": ".kimi-code/skills"
     }
   ],
   "probeCapabilities": [