skill-family-engineering-kit 0.5.0 → 0.7.0

package/CHANGELOG.md

@@ -1,5 +1,48 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.7.0 locale=en baseline=sha256:ed1c59e7cee6e7280d2569e554b07d3b3513f4f3318bf30e374e2d480320f2b7 -->
+## [0.7.0] - 2026-08-21
+
+This release exports the public canonical projection closure builder buildProjectionClosure (FG-4), so callers construct compileProjectionPlan-ready plan closures through one public entry instead of re-implementing the Kit-private ordering, serialization, and digest algorithms.
+
+### Added
+
+- Adds the public skill-family-engineering-kit/profile-spi subpath. It projects the three Profile SPI JSON resources together with the Contracts canonical profile-descriptor.schema.json, and exports schema loaders, verifyProfile, adoption-pin verification, and tightening-only override checks. The data-only verifier fails closed on missing pins and symlink/path escapes and never executes Profile entrypoints.
+- Adds buildProjectionClosure - a pure public builder accepting an array of {path, sha256, mode} members (an explicit type file is also accepted) and returning the canonical plan closure {digestAlgorithm sha256, digest, resourceCount, resources} that compileProjectionPlan accepts verbatim as previousOwnedClosure or externalCandidateClosure; an empty array yields the legal empty closure.
+- The builder shares one normalization and digest source of truth with the compiler closure re-verification - deterministic path.localeCompare ordering, duplicate-path and portable-collision refusal, and the sha256(JSON.stringify(normalizedResources)) byte contract; every refusal fails closed in the existing projection plan input invalid domain (SFC2004 invalid-manifest).
+
+### Changed
+
+- Keeps the compileProjectionPlan input contract unchanged and the four top-level commands (scaffold, adopt-plan, projection, check) unchanged; every 0.6.0 input still compiles to byte-identical plans. The package version moves in lockstep with the Foundation line while the contracts machine contract stays at 1.6.0.
+
+### Upgrade Notes
+
+Version 0.7.0 is the projection closure builder line. Callers that previously assembled plan closures locally must import buildProjectionClosure and pin exactly 0.7.0. A plan closure ({path, type, sha256, mode} members) is not the harness computeResourceClosure resource closure ({path, role, exists, sha256} members) - the two shapes and purposes differ and are not interchangeable.
+<!-- release-skill:changelog:end version=0.7.0 locale=en -->
+
+
+<!-- release-skill:changelog:start version=0.6.0 locale=en baseline=sha256:e84a44b51d513c123ce3c5e91c9e50374c6e899aa021adabe8e44c3ad86eb2b2 -->
+## [0.6.0] - 2026-08-21
+
+This release extends the check command with the entry contract gate and the controlled relock transaction sub-actions, adds external frozen authority projection bindings (FG-3), and carries the nine-class check diagnostics (audit remediation C2).
+
+### Added
+
+- Adds the check entries sub-action - runEntryContractCheck and checkEntriesAction run the shared entry contract gate (SFA-ENTRY-003/004/005/007 and SFA-CONTEXT-001/002) over skill-family.entry-contract.json and SKILL.md bytes; diagnosis only, zero writes.
+- Adds the check relock sub-action - runRelock and relockAction are the one controlled exception to the no-write rule - a fail-closed transaction writing exactly the two contained state documents (.foundation/file-registry.json and skill-family.managed-file-lock.json), with drift validation before the first write and zero writes on any refusal.
+- Adds external frozen authority projection bindings (FG-3) - PROJECTION_AUTHORITY_BINDING_KINDS freezes external-root and caller-bytes; external-root re-reads each authority source from a separate frozen directory through the strict no-follow reader, and caller-bytes binds caller-provided base64 authority bytes to declared sha256 digests with no authority filesystem access at all, keeping the target root free of forged local authority facts.
+
+### Changed
+
+- Extends check diagnostics to nine classes (adds version single-source consistency, public boundary validation, and platform subset declaration validation); COMMAND_SIDE_EFFECTS now documents the entries and relock sub-action semantics.
+- Keeps the four top-level commands (scaffold, adopt-plan, projection, check) unchanged; entries and relock are check sub-actions, not new commands.
+
+### Upgrade Notes
+
+Version 0.6.0 is the Kit gate completion line. Projections whose authority does not live in the target root must declare an authorityBinding of kind external-root or caller-bytes and pin exactly 0.6.0.
+<!-- release-skill:changelog:end version=0.6.0 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.5.0 locale=en baseline=sha256:f83b9c3442e5391149531b198be25131cf45728ff945d4ffc531342996e4e6f3 -->
 ## [0.5.0] - 2026-08-16
 

package/CHANGELOG.zh-CN.md

@@ -1,5 +1,48 @@
 # 变更日志
 
+<!-- release-skill:changelog:start version=0.7.0 locale=zh-CN baseline=sha256:e6070267ab3db289caf998c4539055c3d39dfa16fb5bc7db44689b305fde2e81 -->
+## [0.7.0] - 2026-08-21
+
+本版导出公共规范投影闭包 builder buildProjectionClosure（FG-4），调用方经一个公共入口即可构造 compileProjectionPlan 可直接接受的计划闭包，不再复刻 Kit 私有的排序、序列化与摘要算法。
+
+### 新增
+
+- 新增公共 skill-family-engineering-kit/profile-spi 子路径。它投影三个 Profile SPI JSON 资源与 Contracts canonical profile-descriptor.schema.json，导出 Schema 加载器、verifyProfile、采用 pin 校验和只收紧 overrides 检查。纯数据校验器遇到 pin 缺失、符号链接或路径越界时失败关闭，绝不执行 Profile entrypoint。
+- 新增 buildProjectionClosure：纯函数公共 builder，接受 {path, sha256, mode} 成员数组（可接受显式 type file），返回规范计划闭包 {digestAlgorithm sha256, digest, resourceCount, resources}，可原样作为 compileProjectionPlan 的 previousOwnedClosure 或 externalCandidateClosure；空数组返回合法的空闭包。
+- builder 与编译器闭包复验共享同一规范化与摘要事实源：确定性 path.localeCompare 排序、重复路径与便携路径冲突拒绝、sha256(JSON.stringify(normalizedResources)) 字节合同；全部拒绝在既有 projection plan input invalid 领域内失败关闭（SFC2004 invalid-manifest）。
+
+### 变更
+
+- compileProjectionPlan 入参合同不变，四个顶层命令（scaffold、adopt-plan、projection、check）不变；全部 0.6.0 既有输入仍编译为字节不变的计划。包版本随 Foundation 线锁步，Contracts 机器合同保持 1.6.0。
+
+### 升级说明
+
+0.7.0 是投影闭包 builder 线。此前在本地组装计划闭包的调用方必须导入 buildProjectionClosure 并精确锁定 0.7.0。计划闭包（成员 {path, type, sha256, mode}）不是 harness computeResourceClosure 的资源闭包（成员 {path, role, exists, sha256}）——两者形状与用途不同，不能互换。
+<!-- release-skill:changelog:end version=0.7.0 locale=zh-CN -->
+
+
+<!-- release-skill:changelog:start version=0.6.0 locale=zh-CN baseline=sha256:e48a11bcbdffb317068cb751f914809360aa8f2e2b852b1e436696601f6a2a47 -->
+## [0.6.0] - 2026-08-21
+
+本版为 check 命令新增入口契约门禁与受控 relock 事务子动作，新增外部冻结权威投影绑定（FG-3），并承载九类 check 诊断（审计整改 C2）。
+
+### 新增
+
+- 新增 check entries 子动作：runEntryContractCheck 与 checkEntriesAction 运行共享入口契约门禁（SFA-ENTRY-003/004/005/007 与 SFA-CONTEXT-001/002），作用于 skill-family.entry-contract.json 与 SKILL.md 字节；只诊断、零写入。
+- 新增 check relock 子动作：runRelock 与 relockAction 是零写入规则的唯一受控例外——一次失败关闭事务，精确写入两个受收容状态文档（.foundation/file-registry.json 与 skill-family.managed-file-lock.json），首次写入前做漂移校验，任何拒绝下零写入。
+- 新增外部冻结权威投影绑定（FG-3）：PROJECTION_AUTHORITY_BINDING_KINDS 冻结 external-root 与 caller-bytes；external-root 经严格不跟随读取器从独立的冻结目录重读每个权威源，caller-bytes 将调用方提供的 base64 权威字节绑定到声明的 sha256 摘要、完全不访问权威文件系统，使目标根内不存在伪造的本地权威事实。
+
+### 变更
+
+- check 诊断扩展为九类（新增版本单源一致性、公开边界校验、平台子集限制声明校验）；COMMAND_SIDE_EFFECTS 现记录 entries 与 relock 子动作语义。
+- 四个顶层命令（scaffold、adopt-plan、projection、check）保持不变；entries 与 relock 是 check 子动作，不是新命令。
+
+### 升级说明
+
+0.6.0 是 Kit 门禁补齐线。权威不在目标根内的投影必须声明 kind 为 external-root 或 caller-bytes 的 authorityBinding，并精确锁定 0.6.0。
+<!-- release-skill:changelog:end version=0.6.0 locale=zh-CN -->
+
+
 <!-- release-skill:changelog:start version=0.5.0 locale=zh-CN baseline=sha256:bdeefb2e456f6e9d1348152b464c701e96a739e514c5a08ca3576e9982e9b7e0 -->
 ## [0.5.0] - 2026-08-16
 

package/README.md

@@ -4,27 +4,28 @@
 
 # skill-family-engineering-kit
 
-<!-- release-skill:release-version: 0.5.0 -->
+<!-- release-skill:release-version: 0.7.0 -->
 
 An engineering toolkit used in development and CI. There are **exactly four** top-level commands, and no fifth:
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.5.0** (2026-08-16)
+**0.7.0** (2026-08-21)
 
-This release keeps the stable four-command Kit surface unchanged and strengthens the offline-consumer verification gates to cover the complete third-party production closure of the three Foundation packages.
+This release exports the public canonical projection closure builder buildProjectionClosure (FG-4), so callers construct compileProjectionPlan-ready plan closures through one public entry instead of re-implementing the Kit-private ordering, serialization, and digest algorithms.
 
 **Added**
 
-- Strengthens the offline-consumer verification gates: the third-party closure derivation in candidate-profile-bundle and tarball-source-binding tests is extended from a single-package closure to the complete production closure of the three Foundation packages (identity-deduplicated, npm: alias-aware, range-scoped override selectors, byte identity against the real store directory of pnpm), so the harness runtime-dependency review decision (FND-ADR-011) is continuously verified against the real installed bytes.
+- Adds the public skill-family-engineering-kit/profile-spi subpath. It projects the three Profile SPI JSON resources together with the Contracts canonical profile-descriptor.schema.json, and exports schema loaders, verifyProfile, adoption-pin verification, and tightening-only override checks. The data-only verifier fails closed on missing pins and symlink/path escapes and never executes Profile entrypoints.
+- Adds buildProjectionClosure - a pure public builder accepting an array of {path, sha256, mode} members (an explicit type file is also accepted) and returning the canonical plan closure {digestAlgorithm sha256, digest, resourceCount, resources} that compileProjectionPlan accepts verbatim as previousOwnedClosure or externalCandidateClosure; an empty array yields the legal empty closure.
+- The builder shares one normalization and digest source of truth with the compiler closure re-verification - deterministic path.localeCompare ordering, duplicate-path and portable-collision refusal, and the sha256(JSON.stringify(normalizedResources)) byte contract; every refusal fails closed in the existing projection plan input invalid domain (SFC2004 invalid-manifest).
 
 **Changed**
 
-- Keeps the stable scaffold, adopt-plan, projection, and check commands unchanged.
-- Carries forward the 0.4.0 adoption CLI candidate and the Quickstart Profile v2 offline bundle; no Kit surface or candidate entry point is added or removed in 0.5.0.
+- Keeps the compileProjectionPlan input contract unchanged and the four top-level commands (scaffold, adopt-plan, projection, check) unchanged; every 0.6.0 input still compiles to byte-identical plans. The package version moves in lockstep with the Foundation line while the contracts machine contract stays at 1.6.0.
 
 **Upgrade Notes**
 
-Version 0.5.0 is released on npm and the public mirror. The Kit public surface is unchanged from 0.4.0; pin the package to exactly 0.5.0 for the new contract-spec 1.5.0 line.
+Version 0.7.0 is the projection closure builder line. Callers that previously assembled plan closures locally must import buildProjectionClosure and pin exactly 0.7.0. A plan closure ({path, type, sha256, mode} members) is not the harness computeResourceClosure resource closure ({path, role, exists, sha256} members) - the two shapes and purposes differ and are not interchangeable.
 <!-- release-skill:managed:end id=latest-release -->
 
 | Command | Purpose | Side effects |
@@ -45,7 +46,7 @@ Kit is the "engineering stage" layer, depending on the Harness and Contracts. It
 ## Installation and Minimal Example
 
 ```sh
-npm install --save-dev skill-family-engineering-kit@0.5.0
+npm install --save-dev skill-family-engineering-kit@0.7.0
 npm exec -- skill-family-kit --help
 npm exec -- skill-family-kit scaffold --root <empty-dir> --project-id my-project
 npm exec -- skill-family-kit adopt-plan --root <repo>
@@ -53,7 +54,15 @@ npm exec -- skill-family-kit projection --root <repo>
 npm exec -- skill-family-kit check --root <repo>
 ```
 
-The four commands above cover skeleton generation, read-only inventory, managed projection, and diagnostics respectively; a zero-install form is available via `npm exec --package=skill-family-engineering-kit@0.5.0 -- skill-family-kit --help`.
+The four commands above cover skeleton generation, read-only inventory, managed projection, and diagnostics respectively; a zero-install form is available via `npm exec --package=skill-family-engineering-kit@0.7.0 -- skill-family-kit --help`.
+
+### Public Profile SPI
+
+The `skill-family-engineering-kit/profile-spi` subpath exposes the stable Profile SPI v2 data surface. It exports `verifyProfile`, `verifyAdoptionDigests`, `assessOverridesPolicy`, `loadSpiDefinition`, `loadExtendedDescriptorSchema`, and `loadRuleBaselineCatalog`.
+
+The package carries three SPI JSON resources and the Contracts canonical `profile-descriptor.schema.json`. `profiles/spi` is the only handwritten source; projen mechanically projects those resources and the module into this subpath. The projection changes only the two public package imports and the local schema URL.
+
+`verifyProfile({ profileRoot })` is read-only and data-only. It refuses descriptor errors, missing resources, executable entrypoints, symlink/path escapes, core reverse dependencies, unverified adoption pins, and non-tightening overrides with stable `SPE0000` / `SPE1001`–`SPE1007` result codes. It never executes Profile-provided files. The Profile's domain meaning remains owned by the caller.
 
 ### Report sub-action
 
@@ -158,7 +167,7 @@ This package must not perform git init, commit, push, tag, stash, branch switch,
 - `foundation.kit.scaffold`: generate a precise skeleton in an empty directory, atomic + contained.
 - `foundation.kit.adopt-plan`: strictly read-only inventory and completion determination of an existing repo.
 - `foundation.kit.projection`: managed projection, write only after full validation, zero writes on failure.
-- `foundation.kit.check`: seven check classes, diagnosis only, no fix.
+- `foundation.kit.check`: nine check classes, diagnosis only, no fix.
 - `foundation.kit.report`: projection/check report sub-action orchestration.
 - `foundation.kit.git-probe`: read-only whitelisted Git status probe.
 - `foundation.kit.host`: describe/build/probe/plan, apply stably rejected.

package/README.zh-CN.md

@@ -5,27 +5,28 @@
 
 # skill-family-engineering-kit
 
-<!-- release-skill:release-version: 0.5.0 -->
+<!-- release-skill:release-version: 0.7.0 -->
 
 开发与 CI 阶段使用的工程工具包。**恰好四个**顶层命令，没有第五个：
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.5.0** (2026-08-16)
+**0.7.0** (2026-08-21)
 
-本版保持 Kit 稳定四命令边界不变，并把离线消费者验证门加固为覆盖三个 Foundation 包的完整第三方生产闭包。
+本版导出公共规范投影闭包 builder buildProjectionClosure（FG-4），调用方经一个公共入口即可构造 compileProjectionPlan 可直接接受的计划闭包，不再复刻 Kit 私有的排序、序列化与摘要算法。
 
 **新增**
 
-- 加固离线消费者验证门：candidate-profile-bundle 与 tarball-source-binding 测试中的第三方闭包推导从单包闭包扩展为三个 Foundation 包的完整生产闭包（真实身份去重、npm: 别名感知、range-scoped override selector、对 pnpm 真实本地存储目录的字节身份），使 harness 运行时依赖评审决策（FND-ADR-011）持续对着真实安装字节被验证。
+- 新增公共 skill-family-engineering-kit/profile-spi 子路径。它投影三个 Profile SPI JSON 资源与 Contracts canonical profile-descriptor.schema.json，导出 Schema 加载器、verifyProfile、采用 pin 校验和只收紧 overrides 检查。纯数据校验器遇到 pin 缺失、符号链接或路径越界时失败关闭，绝不执行 Profile entrypoint。
+- 新增 buildProjectionClosure：纯函数公共 builder，接受 {path, sha256, mode} 成员数组（可接受显式 type file），返回规范计划闭包 {digestAlgorithm sha256, digest, resourceCount, resources}，可原样作为 compileProjectionPlan 的 previousOwnedClosure 或 externalCandidateClosure；空数组返回合法的空闭包。
+- builder 与编译器闭包复验共享同一规范化与摘要事实源：确定性 path.localeCompare 排序、重复路径与便携路径冲突拒绝、sha256(JSON.stringify(normalizedResources)) 字节合同；全部拒绝在既有 projection plan input invalid 领域内失败关闭（SFC2004 invalid-manifest）。
 
 **变更**
 
-- 稳定四命令（scaffold、adopt-plan、projection、check）保持不变。
-- 延续 0.4.0 的 adoption CLI 候选与 Quickstart Profile v2 离线 Bundle；0.5.0 未新增或移除任何 Kit 边界或候选入口。
+- compileProjectionPlan 入参合同不变，四个顶层命令（scaffold、adopt-plan、projection、check）不变；全部 0.6.0 既有输入仍编译为字节不变的计划。包版本随 Foundation 线锁步，Contracts 机器合同保持 1.6.0。
 
 **升级说明**
 
-0.5.0 已发布到 npm 与 public 镜像仓。Kit 公开面与 0.4.0 相同；面向新的契约规格 1.5.0 线请把包精确锁定为 0.5.0。
+0.7.0 是投影闭包 builder 线。此前在本地组装计划闭包的调用方必须导入 buildProjectionClosure 并精确锁定 0.7.0。计划闭包（成员 {path, type, sha256, mode}）不是 harness computeResourceClosure 的资源闭包（成员 {path, role, exists, sha256}）——两者形状与用途不同，不能互换。
 <!-- release-skill:managed:end id=latest-release -->
 
 | 命令 | 用途 | 副作用 |
@@ -46,7 +47,7 @@ Kit 是「工程阶段」层，依赖 Harness 与 Contracts。它只做四件事
 ## 安装和最小示例
 
 ```sh
-npm install --save-dev skill-family-engineering-kit@0.5.0
+npm install --save-dev skill-family-engineering-kit@0.7.0
 npm exec -- skill-family-kit --help
 npm exec -- skill-family-kit scaffold --root <empty-dir> --project-id my-project
 npm exec -- skill-family-kit adopt-plan --root <repo>
@@ -54,7 +55,15 @@ npm exec -- skill-family-kit projection --root <repo>
 npm exec -- skill-family-kit check --root <repo>
 ```
 
-以上四条命令分别覆盖生成骨架、只读盘点、受管投影与诊断；零安装形式可用 `npm exec --package=skill-family-engineering-kit@0.5.0 -- skill-family-kit --help`。
+以上四条命令分别覆盖生成骨架、只读盘点、受管投影与诊断；零安装形式可用 `npm exec --package=skill-family-engineering-kit@0.7.0 -- skill-family-kit --help`。
+
+### 公共 Profile SPI
+
+`skill-family-engineering-kit/profile-spi` 子路径提供稳定的 Profile SPI v2 数据表面，导出 `verifyProfile`、`verifyAdoptionDigests`、`assessOverridesPolicy`、`loadSpiDefinition`、`loadExtendedDescriptorSchema` 与 `loadRuleBaselineCatalog`。
+
+包内携带三个 SPI JSON 资源与 Contracts canonical `profile-descriptor.schema.json`。`profiles/spi` 是唯一手写真源；projen 将这些资源和模块机械投影到该子路径。投影只修改两个公共包导入和一个本地 Schema URL。
+
+`verifyProfile({ profileRoot })` 只读处理纯数据。遇到 descriptor 错误、资源缺失、可执行 entrypoint、符号链接或路径越界、反向依赖公共核心、未验证的采用 pin、未收紧的 overrides 时，以稳定 `SPE0000` / `SPE1001`–`SPE1007` 结果码失败关闭；它不会执行 Profile 提供的文件。Profile 的领域含义仍由调用方负责。
 
 ### 报告子动作
 
@@ -159,7 +168,7 @@ projection 只写同时满足两个条件的路径：manifest 列出，且目标
 - `foundation.kit.scaffold`：空目录生成精确骨架，原子 + 收容。
 - `foundation.kit.adopt-plan`：存量仓严格只读盘点与完成判定。
 - `foundation.kit.projection`：受管投影，全校验后才写，失败零写。
-- `foundation.kit.check`：七类检查只诊断不修复。
+- `foundation.kit.check`：九类检查只诊断不修复。
 - `foundation.kit.report`：projection/check report 子动作编排。
 - `foundation.kit.git-probe`：只读白名单 Git 状态探测。
 - `foundation.kit.host`：describe/build/probe/plan，apply 稳定拒绝。

package/docs/agents/capability-catalog.en.json

@@ -282,6 +282,42 @@
     "Domain audit semantics: route to an independent audit consumer"
    ]
   },
+  {
+   "id": "foundation.contracts.token-estimate-consumption",
+   "intent": "Defines the minimal consumption contract of the token estimate record - which field carries the numeric estimate, the degraded bare-integer shape, and the fail-closed refusal semantics",
+   "useWhen": [
+    "You need to extract the numeric estimate from a token-estimate-record and validate the degraded shape",
+    "You need to refuse records whose estimator or target field does not match"
+   ],
+   "doNotUseWhen": [
+    "You need to produce an estimate record (owned by the harness estimator)",
+    "You need to interpret the business meaning of an estimate"
+   ],
+   "prerequisites": [],
+   "inputs": [
+    "A token-estimate-record document or its degraded bare-integer shape"
+   ],
+   "outputs": [
+    "A consumption result carrying the numeric estimate and source identity, or a fail-closed refusal"
+   ],
+   "sideEffects": [
+    "Pure functions; no filesystem, Git, network, or process side effects"
+   ],
+   "failureSemantics": [
+    "Estimator mismatch or missing target field fails closed with a stable error kind",
+    "Refusals carry a closed-enum reason and never degrade silently"
+   ],
+   "invariants": [
+    "Results of different estimators are never mixed silently",
+    "The consumption contract adds no top-level object class"
+   ],
+   "ownedByCaller": [
+    "When to estimate and the business interpretation of results"
+   ],
+   "routeElsewhere": [
+    "Estimate record generation: foundation.harness.token-estimation"
+   ]
+  },
   {
    "id": "foundation.harness.contract-validation",
    "intent": "Resolve the contract context in the Node runtime and reuse the Contracts validator to validate contract documents and cache validator instances.",
@@ -794,13 +830,14 @@
   },
   {
    "id": "foundation.harness.token-estimation",
-   "intent": "Provide a deterministic upper-bound estimate for text: a pure UTF-8 byte-count function with no model, network, or tokenizer dependency",
+   "intent": "Provide deterministic estimates for text: a UTF-8 byte-count upper bound and a token count based on CJK code point / whitespace segmentation; both are pure functions with no model, network, or tokenizer dependency, and results carry estimator identity and version",
    "useWhen": [
     "Need an upper bound on text consumption without calling a model",
-    "Need a contractual, verifiable, timestamp-free estimation result object"
+    "Need a deterministic, replayable token count for mixed CJK/ASCII, pure CJK, or pure ASCII input",
+    "Need a contractual, verifiable, timestamp-free estimation result object that records which estimator produced it"
    ],
    "doNotUseWhen": [
-    "Need real token counts or semantic estimates (the primitive does not promise precision)"
+    "Need real token counts from a target model tokenizer or semantic estimates (the primitive does not promise precision)"
    ],
    "prerequisites": [
     "Input is a JavaScript string"
@@ -809,16 +846,20 @@
     "A text string"
    ],
    "outputs": [
-    "A token-estimate-result contract object (inputBytes equals upperBound)"
+    "A token-estimate-result contract object (inputBytes equals upperBound)",
+    "A token estimation record (estimator id, version, algorithm identifier, and segmentation statistics; tokens equals CJK characters plus OTHER runs)"
    ],
    "sideEffects": [
-    "None: pure function with zero dependencies"
+    "None: pure functions with zero dependencies; the CLI only reads command-line arguments, files, or stdin and only writes stdout"
    ],
    "failureSemantics": [
-    "Non-string input throws TypeError"
+    "Non-string input throws TypeError",
+    "The CLI exits 2 on argument errors and 0 on success"
    ],
    "invariants": [
-    "Identical input produces identical output; deterministic byte counting",
+    "Identical input produces identical output; deterministic byte counting and deterministic segmentation",
+    "Each CJK code point counts 1 token and terminates any open OTHER run before it; whitespace contributes no tokens",
+    "Every estimation record carries the estimator id and version (SFA-CONTEXT-028); results from different estimators are never mixed silently",
     "guarantees is a closed enumeration and the result carries no timestamp"
    ],
    "ownedByCaller": [
@@ -865,6 +906,117 @@
     "Pricing and billing semantics: keep with the consumer"
    ]
   },
+  {
+   "id": "foundation.harness.supervise-process",
+   "intent": "Supervise one bounded subprocess through a full lifecycle with consumer-supplied timeouts, SIGTERM-to-SIGKILL escalation, terminal-progress observation and closed-enum termination evidence.",
+   "useWhen": [
+    "Need to run a subprocess under a bounded lifecycle with a hard ceiling and deterministic termination evidence",
+    "Need closed-enum watchdog/termination reasons that consumers can map mechanically"
+   ],
+   "doNotUseWhen": [
+    "Need the supervisor to retry or restart the process (workflow-orchestration exclusion)"
+   ],
+   "prerequisites": [
+    "The consumer supplies the command, cwd, and a timeout policy with maxSeconds and killGraceSeconds"
+   ],
+   "inputs": [
+    "Command/args/cwd, timeout policy, optional progress and terminal progress paths, optional budget and long-tool hooks, optional evidence path"
+   ],
+   "outputs": [
+    "One frozen watchdog-termination-envelope per call (single writer)"
+   ],
+   "sideEffects": [
+    "Spawns and terminates the supervised process and its process group",
+    "Optionally persists a supervision trace and the final envelope at evidencePath"
+   ],
+   "failureSemantics": [
+    "Policy shape errors throw SFC2004 + timeout-policy-invalid; mechanism failures reject SFC2004 + supervise-process-failed with the termination evidence in details; external process disappearance fails closed as no_terminal_result"
+   ],
+   "invariants": [
+    "The mechanism holds no timeout values, budget thresholds or restart policy",
+    "Liveness is confirmed only by explicit events and process-group probes; ps is never used for liveness guessing"
+   ],
+   "ownedByCaller": [
+    "The command, the timeout numbers, budget thresholds, terminal-record semantics and any restart strategy"
+   ],
+   "routeElsewhere": [
+    "Restart/retry orchestration: workflow-orchestration exclusion, stays with the upper orchestration layer"
+   ]
+  },
+  {
+   "id": "foundation.harness.strict-read",
+   "intent": "Reads one existing authority file with containment, no-follow symlink refusal, regular-file identity re-assertion, and a sha256 digest receipt",
+   "useWhen": [
+    "You need to read a frozen authority file and bind its byte digest",
+    "You need to verify an authority file against a frozen digest before delivery"
+   ],
+   "doNotUseWhen": [
+    "You need to read directories or symlink targets",
+    "You need to write or replace files (owned by the strict write path)"
+   ],
+   "prerequisites": [],
+   "inputs": [
+    "A contained root and a relative path; optionally an expectedSha256 frozen digest"
+   ],
+   "outputs": [
+    "The file content plus a sha256 digest receipt of the exact bytes read"
+   ],
+   "sideEffects": [
+    "Read-only filesystem access (lstat/open/read)"
+   ],
+   "failureSemantics": [
+    "Symlinks, non-regular files, or digest mismatches fail closed without delivering content",
+    "Path escape is refused by the containment layer before any read"
+   ],
+   "invariants": [
+    "Opens with O_NOFOLLOW so a link swapped in after the identity check is never followed",
+    "The receipt digest covers exactly the bytes that were read"
+   ],
+   "ownedByCaller": [
+    "The provenance and trust anchor of the frozen digest",
+    "The remediation policy after a refused read"
+   ],
+   "routeElsewhere": [
+    "Writes and publication: foundation.harness.atomic-write"
+   ]
+  },
+  {
+   "id": "foundation.harness.url-credential-redaction",
+   "intent": "Strips the userinfo credential component from any URL value before it reaches disk or logs",
+   "useWhen": [
+    "You need to persist or log a URL that may carry credentials",
+    "You need unparseable input to degrade safely to a placeholder"
+   ],
+   "doNotUseWhen": [
+    "You need to keep or parse the credential itself (credentials never enter Foundation)",
+    "You need to handle non-URL secret material"
+   ],
+   "prerequisites": [],
+   "inputs": [
+    "Any string input (URL or non-URL)"
+   ],
+   "outputs": [
+    "The redacted URL string or the opaque REDACTED_URL_PLACEHOLDER"
+   ],
+   "sideEffects": [
+    "Pure function; no side effects"
+   ],
+   "failureSemantics": [
+    "Unparseable input degrades to the opaque placeholder and never leaks the original",
+    "The output never carries userinfo bytes"
+   ],
+   "invariants": [
+    "Redaction happens before any persistence or logging",
+    "The placeholder is a frozen constant carrying no input information"
+   ],
+   "ownedByCaller": [
+    "Which input values are treated as URLs",
+    "The downstream use of redacted values"
+   ],
+   "routeElsewhere": [
+    "Credential management and rotation: caller security boundary"
+   ]
+  },
   {
    "id": "foundation.harness.errors",
    "intent": "Define the Harness mechanism error types and stable error classes, unifying error classification.",
@@ -939,7 +1091,7 @@
    "intent": "Perform a strict read-only inventory of an existing repo (classification, nested-repo discovery, migration list, completion judgment), writing no files and migrating nothing automatically.",
    "useWhen": [
     "Need to classify an existing repo as direct-adoption / compatibility-layer / keep-business / foundation-gap",
-    "Need to generate a handoff draft or a completion judgment for migration"
+    "Need to generate a profile draft (adoption declaration and overrides) or a completion judgment for migration"
    ],
    "doNotUseWhen": [
     "Need to auto-rewrite the existing repo (writing files and auto-migration are forbidden)"
@@ -951,7 +1103,7 @@
     "Target root, migration-list path"
    ],
    "outputs": [
-    "Adoption classification, completion judgment, handoff draft (output only, not written to disk)"
+    "Adoption classification, completion judgment, profile draft (output only, not written to disk)"
    ],
    "sideEffects": [
     "No file writes (strictly read-only)",
@@ -984,7 +1136,8 @@
     "The projection manifest is registered"
    ],
    "inputs": [
-    "Projection manifest, target root"
+    "Projection manifest, target root",
+    "Plan closures (previousOwnedClosure / externalCandidateClosure) built through the public buildProjectionClosure entry instead of re-implementing the Kit-private ordering, serialization, and digest algorithms"
    ],
    "outputs": [
     "Projected files (only when all checks pass)"
@@ -1009,7 +1162,7 @@
   },
   {
    "id": "foundation.kit.check",
-   "intent": "Diagnose only, do not fix: run the seven check classes contracts/drift/closure/version/docs/git/identity and output findings.",
+   "intent": "Diagnose only, do not fix: run the nine check classes contracts/drift/closure/version/docs/git/identity/boundary/platform and output findings.",
    "useWhen": [
     "Need to surface engineering inconsistencies without auto-modifying",
     "Need to narrow the check scope via --only"
@@ -1019,7 +1172,7 @@
    ],
    "prerequisites": [],
    "inputs": [
-    "--only values: contracts|drift|closure|version|docs|git|identity"
+    "--only values: contracts|drift|closure|version|docs|git|identity|boundary|platform"
    ],
    "outputs": [
     "Findings list; exit code findings=1, mechanism=2"
@@ -1031,7 +1184,7 @@
     "findings exit code 1; mechanism rejection exit code 2"
    ],
    "invariants": [
-    "CHECK_CLASSES is a closed set of seven classes, not expanded"
+    "CHECK_CLASSES is a closed set of nine classes, not expanded"
    ],
    "ownedByCaller": [
     "Business disposition of each finding"
@@ -1218,6 +1371,77 @@
     "Auto-fix: the caller"
    ]
   },
+  {
+   "id": "foundation.kit.entry-check",
+   "intent": "Read the entry-contract declaration and run five checks per entry: physical existence, logical-name consistency, human-entry registration, side-effect class, and token budget.",
+   "useWhen": [
+    "Need to verify the entry-contract declaration against the physical SKILL.md",
+    "Need to check entry logical names, side-effect classes, and token budgets"
+   ],
+   "doNotUseWhen": [
+    "Need to fix the declaration or entries (check only diagnoses, it does not fix)"
+   ],
+   "prerequisites": [],
+   "inputs": [
+    "Project root (carrying skill-family.entry-contract.json and package.json)"
+   ],
+   "outputs": [
+    "Entry-check report (kind skill-family.entry-check-report) and findings"
+   ],
+   "sideEffects": [
+    "Read-only read of the declaration, package.json, and entry files"
+   ],
+   "failureSemantics": [
+    "A missing declaration is data, never a finding",
+    "Each failed check produces a finding of a distinct kind"
+   ],
+   "invariants": [
+    "Does not modify any file",
+    "Adds no fifth top-level command; it runs as the check entries sub-action"
+   ],
+   "ownedByCaller": [
+    "Remediation of the declaration and entries"
+   ],
+   "routeElsewhere": [
+    "Auto-remediation: the caller"
+   ]
+  },
+  {
+   "id": "foundation.kit.relock",
+   "intent": "Run the controlled relock transaction: register newly handwritten files into .foundation/file-registry.json and recompute skill-family.managed-file-lock.json from the current bytes in one fail-closed operation.",
+   "useWhen": [
+    "Need to admit a newly handwritten file into the closed world without hand-editing the registry",
+    "Need to recompute the managed-file lock from current bytes after registration"
+   ],
+   "doNotUseWhen": [
+    "Need to legitimize drifted managed bytes (relock refuses drift)",
+    "Need to register symlinks or non-regular files (refused)"
+   ],
+   "prerequisites": [],
+   "inputs": [
+    "Project root carrying .foundation/file-registry.json and skill-family.managed-file-lock.json"
+   ],
+   "outputs": [
+    "Relock report (kind skill-family.relock-report)"
+   ],
+   "sideEffects": [
+    "Writes exactly two contained state documents: the registry and the managed-file lock"
+   ],
+   "failureSemantics": [
+    "Every refusal leaves the target untouched (zero writes)",
+    "A half-updated state is never presented as success"
+   ],
+   "invariants": [
+    "Adds no fifth top-level command; it runs as the check relock sub-action",
+    "The new lock binds the new registry bytes before either document is committed"
+   ],
+   "ownedByCaller": [
+    "Reconciliation of drifted managed bytes before relocking"
+   ],
+   "routeElsewhere": [
+    "Auto-remediation: the caller"
+   ]
+  },
   {
    "id": "foundation.kit.cli",
    "intent": "Provide the skill-family-kit CLI entry point, dispatching the four top-level commands and sub-actions, and rejecting mutation flags at the entry point.",
@@ -1256,10 +1480,11 @@
   },
   {
    "id": "foundation.profile.extension-spi",
-   "intent": "Declare the extension mechanism for host and project-shape differences: differences (adds/overrides/removes) and open extension points (host-projection/artifact-render/surface-scan), validating Profile legitimacy.",
+   "intent": "Declare the extension mechanism for host and project-shape differences, and consume the public skill-family-engineering-kit/profile-spi projection: differences (adds/overrides/removes) and open extension points (host-projection/artifact-render/surface-scan) are validated as data-only Profile input.",
    "useWhen": [
     "Need to declare project-shape differences without changing the common core",
-    "Need to inject extension-point data resources into the stable SPI"
+    "Need to inject extension-point data resources into the stable SPI",
+    "Need to load the public SPI schema and verifyProfile entry from skill-family-engineering-kit/profile-spi"
    ],
    "doNotUseWhen": [
     "Need to stuff business semantics into the common core (coreOwned targets are off-limits)",
@@ -1272,7 +1497,7 @@
     "profileRoot、descriptorRelPath"
    ],
    "outputs": [
-    "SPI result code (SPE0000/1001..1005)"
+    "SPI result code (SPE0000/1001..1007), plus the public base and extended schema loaders"
    ],
    "sideEffects": [
     "No side effects (read-only Profile validation)"
@@ -1283,7 +1508,8 @@
    ],
    "invariants": [
     "coreOwned = packages/commands/namespacePrefixes are off-limits targets",
-    "The entrypoint must be a JSON data resource"
+    "The entrypoint must be a JSON data resource",
+    "The public projection keeps the three SPI JSON resources and Contracts base schema byte-identical"
    ],
    "ownedByCaller": [
     "Business semantics of the difference"