skill-family-engineering-kit 0.4.0 → 0.6.0

package/CHANGELOG.md

@@ -1,5 +1,47 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.6.0 locale=en baseline=sha256:e84a44b51d513c123ce3c5e91c9e50374c6e899aa021adabe8e44c3ad86eb2b2 -->
+## [0.6.0] - 2026-08-21
+
+This release extends the check command with the entry contract gate and the controlled relock transaction sub-actions, adds external frozen authority projection bindings (FG-3), and carries the nine-class check diagnostics (audit remediation C2).
+
+### Added
+
+- Adds the check entries sub-action - runEntryContractCheck and checkEntriesAction run the shared entry contract gate (SFA-ENTRY-003/004/005/007 and SFA-CONTEXT-001/002) over skill-family.entry-contract.json and SKILL.md bytes; diagnosis only, zero writes.
+- Adds the check relock sub-action - runRelock and relockAction are the one controlled exception to the no-write rule - a fail-closed transaction writing exactly the two contained state documents (.foundation/file-registry.json and skill-family.managed-file-lock.json), with drift validation before the first write and zero writes on any refusal.
+- Adds external frozen authority projection bindings (FG-3) - PROJECTION_AUTHORITY_BINDING_KINDS freezes external-root and caller-bytes; external-root re-reads each authority source from a separate frozen directory through the strict no-follow reader, and caller-bytes binds caller-provided base64 authority bytes to declared sha256 digests with no authority filesystem access at all, keeping the target root free of forged local authority facts.
+
+### Changed
+
+- Extends check diagnostics to nine classes (adds version single-source consistency, public boundary validation, and platform subset declaration validation); COMMAND_SIDE_EFFECTS now documents the entries and relock sub-action semantics.
+- Keeps the four top-level commands (scaffold, adopt-plan, projection, check) unchanged; entries and relock are check sub-actions, not new commands.
+
+### Upgrade Notes
+
+Version 0.6.0 is the Kit gate completion line. Projections whose authority does not live in the target root must declare an authorityBinding of kind external-root or caller-bytes and pin exactly 0.6.0.
+<!-- release-skill:changelog:end version=0.6.0 locale=en -->
+
+
+<!-- release-skill:changelog:start version=0.5.0 locale=en baseline=sha256:f83b9c3442e5391149531b198be25131cf45728ff945d4ffc531342996e4e6f3 -->
+## [0.5.0] - 2026-08-16
+
+This release keeps the stable four-command Kit surface unchanged and strengthens the offline-consumer verification gates to cover the complete third-party production closure of the three Foundation packages.
+
+### Added
+
+- Strengthens the offline-consumer verification gates: the third-party closure derivation in candidate-profile-bundle and tarball-source-binding tests is extended from a single-package closure to the complete production closure of the three Foundation packages (identity-deduplicated, npm: alias-aware, range-scoped override selectors, byte identity against the real store directory of pnpm), so the harness runtime-dependency review decision (FND-ADR-011) is continuously verified against the real installed bytes.
+
+### Changed
+
+- Keeps the stable scaffold, adopt-plan, projection, and check commands unchanged.
+- Carries forward the 0.4.0 adoption CLI candidate and the Quickstart Profile v2 offline bundle; no Kit surface or candidate entry point is added or removed in 0.5.0.
+
+### Upgrade Notes
+
+Version 0.5.0 is released on npm and the public mirror. The Kit public surface is unchanged from 0.4.0; pin the package to exactly 0.5.0 for the new contract-spec 1.5.0 line.
+<!-- release-skill:changelog:end version=0.5.0 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.4.0 locale=en baseline=sha256:b75bcca6a62cddc63d0a8d88faf268415aec803bcf00e04aacd797907d1ea6e8 -->
 ## [0.4.0] - 2026-08-16
 

package/CHANGELOG.zh-CN.md

@@ -1,5 +1,47 @@
 # 变更日志
 
+<!-- release-skill:changelog:start version=0.6.0 locale=zh-CN baseline=sha256:e48a11bcbdffb317068cb751f914809360aa8f2e2b852b1e436696601f6a2a47 -->
+## [0.6.0] - 2026-08-21
+
+本版为 check 命令新增入口契约门禁与受控 relock 事务子动作，新增外部冻结权威投影绑定（FG-3），并承载九类 check 诊断（审计整改 C2）。
+
+### 新增
+
+- 新增 check entries 子动作：runEntryContractCheck 与 checkEntriesAction 运行共享入口契约门禁（SFA-ENTRY-003/004/005/007 与 SFA-CONTEXT-001/002），作用于 skill-family.entry-contract.json 与 SKILL.md 字节；只诊断、零写入。
+- 新增 check relock 子动作：runRelock 与 relockAction 是零写入规则的唯一受控例外——一次失败关闭事务，精确写入两个受收容状态文档（.foundation/file-registry.json 与 skill-family.managed-file-lock.json），首次写入前做漂移校验，任何拒绝下零写入。
+- 新增外部冻结权威投影绑定（FG-3）：PROJECTION_AUTHORITY_BINDING_KINDS 冻结 external-root 与 caller-bytes；external-root 经严格不跟随读取器从独立的冻结目录重读每个权威源，caller-bytes 将调用方提供的 base64 权威字节绑定到声明的 sha256 摘要、完全不访问权威文件系统，使目标根内不存在伪造的本地权威事实。
+
+### 变更
+
+- check 诊断扩展为九类（新增版本单源一致性、公开边界校验、平台子集限制声明校验）；COMMAND_SIDE_EFFECTS 现记录 entries 与 relock 子动作语义。
+- 四个顶层命令（scaffold、adopt-plan、projection、check）保持不变；entries 与 relock 是 check 子动作，不是新命令。
+
+### 升级说明
+
+0.6.0 是 Kit 门禁补齐线。权威不在目标根内的投影必须声明 kind 为 external-root 或 caller-bytes 的 authorityBinding，并精确锁定 0.6.0。
+<!-- release-skill:changelog:end version=0.6.0 locale=zh-CN -->
+
+
+<!-- release-skill:changelog:start version=0.5.0 locale=zh-CN baseline=sha256:bdeefb2e456f6e9d1348152b464c701e96a739e514c5a08ca3576e9982e9b7e0 -->
+## [0.5.0] - 2026-08-16
+
+本版保持 Kit 稳定四命令边界不变，并把离线消费者验证门加固为覆盖三个 Foundation 包的完整第三方生产闭包。
+
+### 新增
+
+- 加固离线消费者验证门：candidate-profile-bundle 与 tarball-source-binding 测试中的第三方闭包推导从单包闭包扩展为三个 Foundation 包的完整生产闭包（真实身份去重、npm: 别名感知、range-scoped override selector、对 pnpm 真实本地存储目录的字节身份），使 harness 运行时依赖评审决策（FND-ADR-011）持续对着真实安装字节被验证。
+
+### 变更
+
+- 稳定四命令（scaffold、adopt-plan、projection、check）保持不变。
+- 延续 0.4.0 的 adoption CLI 候选与 Quickstart Profile v2 离线 Bundle；0.5.0 未新增或移除任何 Kit 边界或候选入口。
+
+### 升级说明
+
+0.5.0 已发布到 npm 与 public 镜像仓。Kit 公开面与 0.4.0 相同；面向新的契约规格 1.5.0 线请把包精确锁定为 0.5.0。
+<!-- release-skill:changelog:end version=0.5.0 locale=zh-CN -->
+
+
 <!-- release-skill:changelog:start version=0.4.0 locale=zh-CN baseline=sha256:0305934fb2f833eff10b17014f551533bfca9e9e51d3820a5a1e62613a3edb6a -->
 ## [0.4.0] - 2026-08-16
 

package/README.md

@@ -4,28 +4,29 @@
 
 # skill-family-engineering-kit
 
-<!-- release-skill:release-version: 0.4.0 -->
+<!-- release-skill:release-version: 0.6.0 -->
 
 An engineering toolkit used in development and CI. There are **exactly four** top-level commands, and no fifth:
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.4.0** (2026-08-16)
+**0.6.0** (2026-08-21)
 
-This release adds the candidate adoption CLI and adoption mechanisms to the Engineering Kit while preserving the stable four-command surface and the 0.3.0 offline bundle.
+This release extends the check command with the entry contract gate and the controlled relock transaction sub-actions, adds external frozen authority projection bindings (FG-3), and carries the nine-class check diagnostics (audit remediation C2).
 
 **Added**
 
-- Adds the adoption-cli candidate, a stdin/stdout CLI that assesses adoption bindings, legacy exit lists, and legacy references through the migration manifest, and verifies managed-bundle identity and harness surface inventory.
-- Adds the adoption-mechanisms candidate module as the shared implementation behind the adoption CLI.
+- Adds the check entries sub-action - runEntryContractCheck and checkEntriesAction run the shared entry contract gate (SFA-ENTRY-003/004/005/007 and SFA-CONTEXT-001/002) over skill-family.entry-contract.json and SKILL.md bytes; diagnosis only, zero writes.
+- Adds the check relock sub-action - runRelock and relockAction are the one controlled exception to the no-write rule - a fail-closed transaction writing exactly the two contained state documents (.foundation/file-registry.json and skill-family.managed-file-lock.json), with drift validation before the first write and zero writes on any refusal.
+- Adds external frozen authority projection bindings (FG-3) - PROJECTION_AUTHORITY_BINDING_KINDS freezes external-root and caller-bytes; external-root re-reads each authority source from a separate frozen directory through the strict no-follow reader, and caller-bytes binds caller-provided base64 authority bytes to declared sha256 digests with no authority filesystem access at all, keeping the target root free of forged local authority facts.
 
 **Changed**
 
-- Keeps the stable scaffold, adopt-plan, projection, and check commands unchanged.
-- Carries forward the 0.3.0 Quickstart Profile v2 offline bundle (standalone validators selected by schema $id, full provenance recording) and the candidate plugin skill naming checker.
+- Extends check diagnostics to nine classes (adds version single-source consistency, public boundary validation, and platform subset declaration validation); COMMAND_SIDE_EFFECTS now documents the entries and relock sub-action semantics.
+- Keeps the four top-level commands (scaffold, adopt-plan, projection, check) unchanged; entries and relock are check sub-actions, not new commands.
 
 **Upgrade Notes**
 
-Version 0.4.0 is released on npm and the public mirror. The adoption CLI is a candidate entry point; invoke it through its explicit candidate subpath and pin the package to exactly 0.4.0.
+Version 0.6.0 is the Kit gate completion line. Projections whose authority does not live in the target root must declare an authorityBinding of kind external-root or caller-bytes and pin exactly 0.6.0.
 <!-- release-skill:managed:end id=latest-release -->
 
 | Command | Purpose | Side effects |
@@ -46,7 +47,7 @@ Kit is the "engineering stage" layer, depending on the Harness and Contracts. It
 ## Installation and Minimal Example
 
 ```sh
-npm install --save-dev skill-family-engineering-kit@0.4.0
+npm install --save-dev skill-family-engineering-kit@0.6.0
 npm exec -- skill-family-kit --help
 npm exec -- skill-family-kit scaffold --root <empty-dir> --project-id my-project
 npm exec -- skill-family-kit adopt-plan --root <repo>
@@ -54,7 +55,7 @@ npm exec -- skill-family-kit projection --root <repo>
 npm exec -- skill-family-kit check --root <repo>
 ```
 
-The four commands above cover skeleton generation, read-only inventory, managed projection, and diagnostics respectively; a zero-install form is available via `npm exec --package=skill-family-engineering-kit@0.4.0 -- skill-family-kit --help`.
+The four commands above cover skeleton generation, read-only inventory, managed projection, and diagnostics respectively; a zero-install form is available via `npm exec --package=skill-family-engineering-kit@0.6.0 -- skill-family-kit --help`.
 
 ### Report sub-action
 
@@ -159,7 +160,7 @@ This package must not perform git init, commit, push, tag, stash, branch switch,
 - `foundation.kit.scaffold`: generate a precise skeleton in an empty directory, atomic + contained.
 - `foundation.kit.adopt-plan`: strictly read-only inventory and completion determination of an existing repo.
 - `foundation.kit.projection`: managed projection, write only after full validation, zero writes on failure.
-- `foundation.kit.check`: seven check classes, diagnosis only, no fix.
+- `foundation.kit.check`: nine check classes, diagnosis only, no fix.
 - `foundation.kit.report`: projection/check report sub-action orchestration.
 - `foundation.kit.git-probe`: read-only whitelisted Git status probe.
 - `foundation.kit.host`: describe/build/probe/plan, apply stably rejected.

package/README.zh-CN.md

@@ -5,28 +5,29 @@
 
 # skill-family-engineering-kit
 
-<!-- release-skill:release-version: 0.4.0 -->
+<!-- release-skill:release-version: 0.6.0 -->
 
 开发与 CI 阶段使用的工程工具包。**恰好四个**顶层命令，没有第五个：
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.4.0** (2026-08-16)
+**0.6.0** (2026-08-21)
 
-本版为 Engineering Kit 新增候选 adoption CLI 与 adoption mechanisms，同时保持稳定四命令边界与 0.3.0 的离线 Bundle 不变。
+本版为 check 命令新增入口契约门禁与受控 relock 事务子动作，新增外部冻结权威投影绑定（FG-3），并承载九类 check 诊断（审计整改 C2）。
 
 **新增**
 
-- 新增 adoption-cli 候选：基于 stdin/stdout 的 CLI，通过 migration manifest 评估 adoption 绑定、遗留 exit list 与遗留引用，并校验 managed-bundle 身份与 harness 表面清单。
-- 新增 adoption-mechanisms 候选模块，作为 adoption CLI 的共享实现。
+- 新增 check entries 子动作：runEntryContractCheck 与 checkEntriesAction 运行共享入口契约门禁（SFA-ENTRY-003/004/005/007 与 SFA-CONTEXT-001/002），作用于 skill-family.entry-contract.json 与 SKILL.md 字节；只诊断、零写入。
+- 新增 check relock 子动作：runRelock 与 relockAction 是零写入规则的唯一受控例外——一次失败关闭事务，精确写入两个受收容状态文档（.foundation/file-registry.json 与 skill-family.managed-file-lock.json），首次写入前做漂移校验，任何拒绝下零写入。
+- 新增外部冻结权威投影绑定（FG-3）：PROJECTION_AUTHORITY_BINDING_KINDS 冻结 external-root 与 caller-bytes；external-root 经严格不跟随读取器从独立的冻结目录重读每个权威源，caller-bytes 将调用方提供的 base64 权威字节绑定到声明的 sha256 摘要、完全不访问权威文件系统，使目标根内不存在伪造的本地权威事实。
 
 **变更**
 
-- 稳定四命令（scaffold、adopt-plan、projection、check）保持不变。
-- 延续 0.3.0 的 Quickstart Profile v2 离线 Bundle（按 schema $id 选择的 standalone validator、完整 provenance 记录）与候选插件技能命名检查器。
+- check 诊断扩展为九类（新增版本单源一致性、公开边界校验、平台子集限制声明校验）；COMMAND_SIDE_EFFECTS 现记录 entries 与 relock 子动作语义。
+- 四个顶层命令（scaffold、adopt-plan、projection、check）保持不变；entries 与 relock 是 check 子动作，不是新命令。
 
 **升级说明**
 
-0.4.0 已发布到 npm 与 public 镜像仓。adoption CLI 是候选入口，须经显式 candidate 子路径调用，并把包精确锁定为 0.4.0。
+0.6.0 是 Kit 门禁补齐线。权威不在目标根内的投影必须声明 kind 为 external-root 或 caller-bytes 的 authorityBinding，并精确锁定 0.6.0。
 <!-- release-skill:managed:end id=latest-release -->
 
 | 命令 | 用途 | 副作用 |
@@ -47,7 +48,7 @@ Kit 是「工程阶段」层，依赖 Harness 与 Contracts。它只做四件事
 ## 安装和最小示例
 
 ```sh
-npm install --save-dev skill-family-engineering-kit@0.4.0
+npm install --save-dev skill-family-engineering-kit@0.6.0
 npm exec -- skill-family-kit --help
 npm exec -- skill-family-kit scaffold --root <empty-dir> --project-id my-project
 npm exec -- skill-family-kit adopt-plan --root <repo>
@@ -55,7 +56,7 @@ npm exec -- skill-family-kit projection --root <repo>
 npm exec -- skill-family-kit check --root <repo>
 ```
 
-以上四条命令分别覆盖生成骨架、只读盘点、受管投影与诊断；零安装形式可用 `npm exec --package=skill-family-engineering-kit@0.4.0 -- skill-family-kit --help`。
+以上四条命令分别覆盖生成骨架、只读盘点、受管投影与诊断；零安装形式可用 `npm exec --package=skill-family-engineering-kit@0.6.0 -- skill-family-kit --help`。
 
 ### 报告子动作
 
@@ -160,7 +161,7 @@ projection 只写同时满足两个条件的路径：manifest 列出，且目标
 - `foundation.kit.scaffold`：空目录生成精确骨架，原子 + 收容。
 - `foundation.kit.adopt-plan`：存量仓严格只读盘点与完成判定。
 - `foundation.kit.projection`：受管投影，全校验后才写，失败零写。
-- `foundation.kit.check`：七类检查只诊断不修复。
+- `foundation.kit.check`：九类检查只诊断不修复。
 - `foundation.kit.report`：projection/check report 子动作编排。
 - `foundation.kit.git-probe`：只读白名单 Git 状态探测。
 - `foundation.kit.host`：describe/build/probe/plan，apply 稳定拒绝。

package/package.json

@@ -8,8 +8,8 @@
     "url": "https://github.com/ifoohoo/skill-family-engineering-kit/issues"
   },
   "dependencies": {
-    "skill-family-contracts": "0.4.0",
-    "skill-family-harness-node": "0.4.0"
+    "skill-family-contracts": "0.6.0",
+    "skill-family-harness-node": "0.6.0"
   },
   "description": "Build-time scaffold, adoption planning, projection, and checks.",
   "engines": {
@@ -46,7 +46,7 @@
     "url": "https://github.com/ifoohoo/skill-family-engineering-kit.git"
   },
   "type": "module",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "scripts": {
     "check": "node --test",
     "test": "node --test"

package/release-notes/0.5.0.yaml

@@ -0,0 +1,21 @@
+version: 0.5.0
+date: 2026-08-16
+locales:
+  en:
+    summary: This release keeps the stable four-command Kit surface unchanged and strengthens the offline-consumer verification gates to cover the complete third-party production closure of the three Foundation packages.
+    changes:
+      added:
+        - "Strengthens the offline-consumer verification gates: the third-party closure derivation in candidate-profile-bundle and tarball-source-binding tests is extended from a single-package closure to the complete production closure of the three Foundation packages (identity-deduplicated, npm: alias-aware, range-scoped override selectors, byte identity against the real store directory of pnpm), so the harness runtime-dependency review decision (FND-ADR-011) is continuously verified against the real installed bytes."
+      changed:
+        - Keeps the stable scaffold, adopt-plan, projection, and check commands unchanged.
+        - Carries forward the 0.4.0 adoption CLI candidate and the Quickstart Profile v2 offline bundle; no Kit surface or candidate entry point is added or removed in 0.5.0.
+    upgradeNotes: Version 0.5.0 is released on npm and the public mirror. The Kit public surface is unchanged from 0.4.0; pin the package to exactly 0.5.0 for the new contract-spec 1.5.0 line.
+  zh-CN:
+    summary: 本版保持 Kit 稳定四命令边界不变，并把离线消费者验证门加固为覆盖三个 Foundation 包的完整第三方生产闭包。
+    changes:
+      added:
+        - "加固离线消费者验证门：candidate-profile-bundle 与 tarball-source-binding 测试中的第三方闭包推导从单包闭包扩展为三个 Foundation 包的完整生产闭包（真实身份去重、npm: 别名感知、range-scoped override selector、对 pnpm 真实本地存储目录的字节身份），使 harness 运行时依赖评审决策（FND-ADR-011）持续对着真实安装字节被验证。"
+      changed:
+        - 稳定四命令（scaffold、adopt-plan、projection、check）保持不变。
+        - 延续 0.4.0 的 adoption CLI 候选与 Quickstart Profile v2 离线 Bundle；0.5.0 未新增或移除任何 Kit 边界或候选入口。
+    upgradeNotes: 0.5.0 已发布到 npm 与 public 镜像仓。Kit 公开面与 0.4.0 相同；面向新的契约规格 1.5.0 线请把包精确锁定为 0.5.0。

package/release-notes/0.6.0.yaml

@@ -0,0 +1,25 @@
+version: 0.6.0
+date: 2026-08-21
+locales:
+  en:
+    summary: This release extends the check command with the entry contract gate and the controlled relock transaction sub-actions, adds external frozen authority projection bindings (FG-3), and carries the nine-class check diagnostics (audit remediation C2).
+    changes:
+      added:
+        - Adds the check entries sub-action - runEntryContractCheck and checkEntriesAction run the shared entry contract gate (SFA-ENTRY-003/004/005/007 and SFA-CONTEXT-001/002) over skill-family.entry-contract.json and SKILL.md bytes; diagnosis only, zero writes.
+        - Adds the check relock sub-action - runRelock and relockAction are the one controlled exception to the no-write rule - a fail-closed transaction writing exactly the two contained state documents (.foundation/file-registry.json and skill-family.managed-file-lock.json), with drift validation before the first write and zero writes on any refusal.
+        - Adds external frozen authority projection bindings (FG-3) - PROJECTION_AUTHORITY_BINDING_KINDS freezes external-root and caller-bytes; external-root re-reads each authority source from a separate frozen directory through the strict no-follow reader, and caller-bytes binds caller-provided base64 authority bytes to declared sha256 digests with no authority filesystem access at all, keeping the target root free of forged local authority facts.
+      changed:
+        - Extends check diagnostics to nine classes (adds version single-source consistency, public boundary validation, and platform subset declaration validation); COMMAND_SIDE_EFFECTS now documents the entries and relock sub-action semantics.
+        - Keeps the four top-level commands (scaffold, adopt-plan, projection, check) unchanged; entries and relock are check sub-actions, not new commands.
+    upgradeNotes: Version 0.6.0 is the Kit gate completion line. Projections whose authority does not live in the target root must declare an authorityBinding of kind external-root or caller-bytes and pin exactly 0.6.0.
+  zh-CN:
+    summary: 本版为 check 命令新增入口契约门禁与受控 relock 事务子动作，新增外部冻结权威投影绑定（FG-3），并承载九类 check 诊断（审计整改 C2）。
+    changes:
+      added:
+        - 新增 check entries 子动作：runEntryContractCheck 与 checkEntriesAction 运行共享入口契约门禁（SFA-ENTRY-003/004/005/007 与 SFA-CONTEXT-001/002），作用于 skill-family.entry-contract.json 与 SKILL.md 字节；只诊断、零写入。
+        - 新增 check relock 子动作：runRelock 与 relockAction 是零写入规则的唯一受控例外——一次失败关闭事务，精确写入两个受收容状态文档（.foundation/file-registry.json 与 skill-family.managed-file-lock.json），首次写入前做漂移校验，任何拒绝下零写入。
+        - 新增外部冻结权威投影绑定（FG-3）：PROJECTION_AUTHORITY_BINDING_KINDS 冻结 external-root 与 caller-bytes；external-root 经严格不跟随读取器从独立的冻结目录重读每个权威源，caller-bytes 将调用方提供的 base64 权威字节绑定到声明的 sha256 摘要、完全不访问权威文件系统，使目标根内不存在伪造的本地权威事实。
+      changed:
+        - check 诊断扩展为九类（新增版本单源一致性、公开边界校验、平台子集限制声明校验）；COMMAND_SIDE_EFFECTS 现记录 entries 与 relock 子动作语义。
+        - 四个顶层命令（scaffold、adopt-plan、projection、check）保持不变；entries 与 relock 是 check 子动作，不是新命令。
+    upgradeNotes: 0.6.0 是 Kit 门禁补齐线。权威不在目标根内的投影必须声明 kind 为 external-root 或 caller-bytes 的 authorityBinding，并精确锁定 0.6.0。

package/src/adopt-plan.mjs

@@ -12,8 +12,8 @@ import {
   findNestedRepositories,
   loadMigrationManifestState,
   MIGRATION_MANIFEST_PATH,
+  REQUIRED_FOUNDATION_PACKAGES,
   validateException,
-  VERIFICATION_EVIDENCE_KINDS,
 } from "./migration.mjs";
 import {
   describeSkeletonFiles,
@@ -54,147 +54,67 @@ async function readExistingBytes(rootAbs, relPath) {
 }
 
 /**
- * The ten-field per-repository adoption hand-off draft.
+ * The per-adoption profile draft (SPI v2; remediation handoff C3/D-8).
  *
- * adopt-plan must carry enough structured data to draft the planner's
- * ten-field hand-off. Fields that cannot be derived mechanically from
- * read-only evidence are marked INCOMPLETE and block the draft — the kit
- * never guesses. The draft binds the target file-set digest and the
- * Foundation plan digest; rendering is a separate read-only planner task
- * that only ever writes the planner-side draft, never the consumer repo.
+ * Replaces the deprecated ten-field hand-off draft of the adoption-lock
+ * era: the adoption-lock concept and its artifact form are abolished, and
+ * the lightweight adoption proof is the profile.json descriptor's own
+ * adoption declaration, machine-verified by verifyProfile (SPI v2):
+ * descriptor-schema completeness of the minimal adoption field set, GK-4
+ * real-file digest discipline (SPE1006), and the tightening-only overrides
+ * policy (SPE1007).
+ *
+ * The draft pre-fills everything derivable from read-only facts:
+ * - descriptor identity (profile id/name from the plan inputs) and the
+ *   frozen contracts base;
+ * - the D-8 minimal adoption field set (foundation_profile, foundation_pin,
+ *   adopted_at) with pin versions pre-filled manifest-declaration-first,
+ *   then from the loaded package constants;
+ * - an empty overrides array — the empty example. Overrides are opt-in
+ *   self-tightening declarations; the kit never enumerates rule examples
+ *   (the core never imports the profile layer).
+ * Every non-derivable field stays null and is listed in incompleteFields —
+ * the kit never guesses. The draft binds the target file-set digest and the
+ * Foundation plan digest.
  */
-export const HANDOFF_FIELDS = Object.freeze([
-  "project-identity",
-  "repository-state",
-  "foundation-binding",
-  "write-set-policy",
-  "legacy-exits",
-  "business-logic-to-keep",
-  "plan-summary",
-  "verification-entries",
-  "legacy-removal-recovery",
-  "authorization-status",
-]);
-
-export function buildHandoffDraft({
-  projectId,
-  rootAbs,
-  agentsFiles,
-  git,
-  gitFacts,
-  unregisteredPaths,
-  nestedRepositories,
-  inputs,
-  migrationManifest,
-  writeSet,
-  conflicts,
-  risks,
-  legacyExitList,
-  legacyReferenceExitList,
-  verificationFacts,
-  migrationState,
-  entries,
-}) {
-  const fields = [];
-  const push = (id, name, status, value) => fields.push({ id, name, status, value });
-
-  // 1. Project identity, absolute path, project-level AGENTS files.
-  push(1, HANDOFF_FIELDS[0], "derived", {
-    projectId,
-    root: rootAbs,
-    agentsFiles: agentsFiles ?? [],
-  });
-
-  // 2. dirty / untracked / nested-repository state — facts or not-proven,
-  // never fabricated.
-  push(2, HANDOFF_FIELDS[1], "derived", {
-    repository: git.repository,
-    headCommit: git.headCommit,
-    cleanState: git.cleanState,
-    dirty: git.cleanState === false,
-    unregisteredContent: git.repository ? null : unregisteredPaths ?? [],
-    nestedRepositories: nestedRepositories ?? [],
-    trackedButIgnored: gitFacts?.status === "proven" ? gitFacts.trackedButIgnored : null,
-    gitFactsStatus: gitFacts?.status ?? "not-proven",
-  });
-
-  // 3. Profile plus exact Foundation versions and digests: only the
-  // manifest-declared binding counts; an undeclared binding is INCOMPLETE.
+export function buildProfileDraft({ inputs, migrationManifest, writeSet, entries }) {
+  const incompleteFields = [];
+
+  // foundation_profile (D-8 minimal set): the adopted foundation profile id
+  // is derivable from the plan inputs; its version and stability are human
+  // decisions the kit never guesses.
+  const foundationProfile = { id: inputs.profileId, version: null, stability: null };
+  incompleteFields.push("adoption.foundation_profile.version", "adoption.foundation_profile.stability");
+
+  // foundation_pin (D-8 minimal set): versions are manifest-declared
+  // bindings first, then loaded package constants; path and sha256 exist
+  // only once the real pinned artifacts have been placed inside the profile
+  // write set — until then they stay null (GK-4 digest discipline: a digest
+  // is computed from real artifact bytes, never guessed).
   const declaredPackages = Array.isArray(migrationManifest?.foundationPackages)
     ? migrationManifest.foundationPackages
-    : null;
-  push(3, HANDOFF_FIELDS[2], declaredPackages && declaredPackages.length > 0 ? "derived" : "INCOMPLETE", {
-    plannedProfile: inputs.profileId,
-    contractsVersion: CONTRACTS_VERSION,
-    foundationPackages: declaredPackages,
-  });
-
-  // 4. Allowed and forbidden write sets.
-  const creates = writeSet.filter((item) => item.action !== "unchanged").map((item) => item.path).sort();
-  push(4, HANDOFF_FIELDS[3], "derived", {
-    allowed: creates,
-    unchanged: writeSet.length - creates.length,
-    forbidden:
-      "nothing outside the listed write set is ever written; the kit never renames, deletes, rewrites handwritten files, or touches remotes; legacy removal is a human-performed exit step",
-  });
-
-  // 5. The validator/builder/docs-pipeline/git-preflight slated for exit.
-  //    Includes both whole-file exits (legacyInfra) and reference-level
-  //    exits (legacyReferences) for retained files.
-  push(5, HANDOFF_FIELDS[4], "derived", {
-    exits: legacyExitList.map((item) => ({ path: item.path, replacedBy: item.replacedBy, status: item.status })),
-    referenceExits: (legacyReferenceExitList ?? []).map((ref) => ({
-      path: ref.path,
-      text: ref.text,
-      replacedBy: ref.replacedBy,
-      status: ref.status,
-      occurrenceCount: ref.occurrenceCount,
-    })),
-  });
-
-  // 6. Business logic that must be kept: never derivable from repo facts.
-  push(6, HANDOFF_FIELDS[5], "INCOMPLETE", {
-    reason: "business-logic boundaries cannot be derived mechanically; a human owner must enumerate them before any hand-off starts",
-  });
-
-  // 7. adopt-plan summary.
-  push(7, HANDOFF_FIELDS[6], "derived", {
-    writeSetCreates: creates.length,
-    writeSetUnchanged: writeSet.length - creates.length,
-    conflicts: conflicts.length,
-    risks: risks.length,
-    migrationState,
-  });
-
-  // 8. Unit / integration / consumer / independent-audit entries: derived
-  // only when every evidence kind is proven. assessVerificationEvidence
-  // always returns one status-bearing fact per kind (undeclared/missing/
-  // invalid-path/unreadable/identity-mismatch/proven), so presence alone
-  // proves nothing — fail-closed, never guessed (FC-12).
-  const evidenceByKind = new Map((verificationFacts ?? []).map((fact) => [fact.kind, fact]));
-  const missingEvidence = VERIFICATION_EVIDENCE_KINDS.filter((kind) => evidenceByKind.get(kind)?.status !== "proven");
-  push(8, HANDOFF_FIELDS[7], missingEvidence.length === 0 ? "derived" : "INCOMPLETE", {
-    entries: (verificationFacts ?? []).map((fact) => ({ kind: fact.kind, path: fact.path ?? null, status: fact.status })),
-    missing: missingEvidence,
-  });
-
-  // 9. How removed legacy implementations can be recovered: never
-  // derivable mechanically (depends on the target's own history/backups).
-  push(9, HANDOFF_FIELDS[8], "INCOMPLETE", {
-    reason: "recovery paths for removed legacy implementations depend on the target's own history and backups; the kit never guesses them",
-  });
-
-  // 10. commit/push/tag/publish authorization: a fixed policy fact —
-  // adoption planning authorizes none of them.
-  push(10, HANDOFF_FIELDS[9], "derived", {
-    commit: false,
-    push: false,
-    tag: false,
-    publish: false,
-    note: "adoption authorizes no git write, tag, or release; each requires explicit per-task user authorization",
+    : [];
+  const declaredByName = new Map(
+    declaredPackages
+      .filter((pkg) => pkg && typeof pkg.name === "string")
+      .map((pkg) => [pkg.name, pkg]),
+  );
+  const loadedVersions = Object.freeze({
+    "skill-family-contracts": CONTRACTS_VERSION,
+    "skill-family-engineering-kit": KIT_VERSION,
   });
+  const packages = {};
+  for (const name of [...REQUIRED_FOUNDATION_PACKAGES].sort()) {
+    const version = declaredByName.get(name)?.version ?? loadedVersions[name] ?? null;
+    if (version === null) incompleteFields.push(`adoption.foundation_pin.packages.${name}.version`);
+    incompleteFields.push(
+      `adoption.foundation_pin.packages.${name}.path`,
+      `adoption.foundation_pin.packages.${name}.sha256`,
+    );
+    packages[name] = { version, path: null, sha256: null };
+  }
 
-  const incompleteFields = fields.filter((field) => field.status === "INCOMPLETE").map((field) => field.name);
+  incompleteFields.push("descriptor.profile.version", "adoption.adopted_at");
 
   // Binding digests: the target file-set summary and the Foundation plan.
   const targetSetDigest = digestBytes(
@@ -205,12 +125,30 @@ export function buildHandoffDraft({
   );
 
   return {
-    kind: "skill-family.handoff-draft",
+    kind: "skill-family.profile-draft",
     schemaVersion: 1,
-    fields,
+    descriptorRelPath: "profile.json",
+    descriptor: {
+      schemaVersion: 1,
+      kind: "skill-family.profile-descriptor",
+      profile: { id: inputs.projectId, name: inputs.projectName, version: null },
+      base: { contractsVersion: CONTRACTS_VERSION },
+      differences: [],
+      spi: [],
+      adoption: {
+        foundation_profile: foundationProfile,
+        foundation_pin: { algorithm: "sha256", packages },
+        adopted_at: null,
+      },
+      overrides: [],
+    },
+    overridesGuidance:
+      "overrides stays empty by default. An override is admissible only when it reuses an existing rule id with a project-level numeric value that strictly tightens the frozen rule baseline catalog in the parameter's declared direction (not-increase: strictly less; not-decrease: strictly greater). Equality and relaxation are refused (SPI v2 SPE1007); risk identification for misuse of tightening belongs to skill-failure-auditor, not to this mechanical check.",
     incompleteFields,
     ready: incompleteFields.length === 0,
     binding: { targetSetDigest, foundationPlanDigest },
+    policyNote:
+      "adoption-lock is deprecated (remediation handoff D-8): the kit no longer produces adoption-lock-form artifacts. The adoption proof is this descriptor's adoption declaration, completed with real artifact paths and digests inside the profile write set and machine-verified by verifyProfile (SPI v2: SPE1006 digest discipline, SPE1007 tightening-only overrides).",
   };
 }
 
@@ -515,29 +453,13 @@ export async function planAdoption({
 
   const existingManagedDeclarations = [...facts.managedSet].sort();
 
-  // The ten-field hand-off draft. Fields that cannot be derived
-  // mechanically stay INCOMPLETE and block readiness — never guessed.
-  const agentsFiles = entries
-    .filter((entry) => entry.kind === "file" && (entry.path === "AGENTS.md" || entry.path === "CLAUDE.md"))
-    .map((entry) => entry.path)
-    .sort();
-  const handoffDraft = buildHandoffDraft({
-    projectId: inputs.projectId,
-    rootAbs,
-    agentsFiles,
-    git,
-    gitFacts,
-    unregisteredPaths,
-    nestedRepositories,
+  // The profile draft: pre-filled adoption declaration (D-8 minimal set)
+  // plus the empty overrides example. Fields that cannot be derived
+  // mechanically stay null and block readiness — never guessed.
+  const profileDraft = buildProfileDraft({
     inputs,
     migrationManifest,
     writeSet,
-    conflicts,
-    risks,
-    legacyExitList,
-    legacyReferenceExitList,
-    verificationFacts,
-    migrationState: completion.state,
     entries,
   });
 
@@ -589,7 +511,7 @@ export async function planAdoption({
       state: completion.state,
       completion,
     },
-    handoffDraft,
+    profileDraft,
     traceability: {
       contractsVersion: CONTRACTS_VERSION,
       skeletonSource: "describeSkeletonFiles",