skill-family-engineering-kit 0.7.0 → 0.8.0

package/package.json

@@ -8,8 +8,8 @@
     "url": "https://github.com/ifoohoo/skill-family-engineering-kit/issues"
   },
   "dependencies": {
-    "skill-family-contracts": "0.7.0",
-    "skill-family-harness-node": "0.7.0"
+    "skill-family-contracts": "0.8.0",
+    "skill-family-harness-node": "0.8.0"
   },
   "description": "Build-time scaffold, adoption planning, projection, and checks.",
   "engines": {
@@ -48,7 +48,7 @@
     "url": "https://github.com/ifoohoo/skill-family-engineering-kit.git"
   },
   "type": "module",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "scripts": {
     "check": "node --test",
     "test": "node --test"

package/profile-spi/extension-spi.json

@@ -1,19 +1,28 @@
 {
   "schemaVersion": 1,
   "kind": "skill-family.profile-extension-spi",
-  "spiVersion": 2,
+  "spiVersion": 3,
   "status": "stable",
-  "description": "Stable extension SPI for Skill Family profiles. A profile may only DECLARE its finite differences from the common core; it can never rewrite, patch, or inject core behavior. Enforcement is mechanical: a frozen pipeline of checks with stable result codes. SPI v2 adds two optional descriptor sections with machine verification: the Foundation adoption declaration (lightweight adoption proof replacing the deprecated adoption-lock concept, remediation handoff D-8) and self-tightening override declarations (remediation handoff D-6).",
-  "baseContracts": "1.1.1",
+  "description": "Stable extension SPI for Skill Family profiles and project adoption declarations. A profile may only DECLARE its finite differences from the common core; a project profile declares its adopting workspace. Enforcement is mechanical with stable result codes.",
+  "baseContracts": "1.7.0",
   "descriptor": {
     "schemaId": "https://contracts.skill-family.example/v1/profile-descriptor.json",
     "object": "profile-descriptor",
     "dialect": "2020-12",
     "policy": "strict",
     "file": "profile.json",
-    "note": "The descriptor is the only intake surface. It is plain validated data (additionalProperties: false at every level), so a profile cannot smuggle behavior in through the descriptor itself. Since SPI v2 the validator composes the two optional top-level sections `adoption` and `overrides` (defined by profiles/spi/profile-adoption.schema.json) onto the contracts profile-descriptor schema before validating; the contracts package stays untouched.",
+    "note": "The descriptor is the provider intake surface. It is plain validated data (additionalProperties: false at every level), so a profile cannot smuggle behavior in through the descriptor itself. SPI v3 also defines the separate project-profile intake; provider validation composes the optional top-level sections `adoption` and `overrides` onto the contracts profile-descriptor schema before validating; the contracts package stays untouched.",
     "extendedSchemaId": "https://spi.profiles.skill-family.example/v2/profile-descriptor-extended.json"
   },
+  "projectProfile": {
+    "schemaId": "https://contracts.skill-family.example/v1/project-profile.json",
+    "object": "project-profile",
+    "dialect": "2020-12",
+    "policy": "strict",
+    "file": "profile.json",
+    "note": "The project profile is the scaffolded workspace adoption declaration and is never accepted by verifyProfile.",
+    "errorCode": "SPE1008"
+  },
   "principles": [
     "declaration-only: differences are data declarations interpreted by the core's own fixed logic; a profile never supplies behavior that the core executes as core logic",
     "closed-core: no difference may add, override, or remove anything owned by the common core (contracts objects, registered protocols, kernel operations, core packages, kit commands)",
@@ -34,16 +43,21 @@
     "adoption-pin-digests",
     "overrides-policy"
   ],
+  "projectProfilePipeline": [
+    "project-profile-schema",
+    "adoption-pin-digests",
+    "overrides-policy"
+  ],
   "resultCodes": [
     {
       "code": "SPE0000",
       "name": "OK",
-      "meaning": "The profile descriptor and all declared SPI resources satisfy every SPI rule; the profile is admitted as a declaration-only extension."
+      "meaning": "The provider descriptor or project profile and all applicable declarations satisfy every SPI rule; the input is admitted as a declaration-only extension or project adoption declaration."
     },
     {
       "code": "SPE1001",
       "name": "DESCRIPTOR_INVALID",
-      "meaning": "The descriptor failed the profile-descriptor schema (since SPI v2 the SPI-composed extended schema that admits the optional adoption and overrides sections) under the declared dialect and strict policy, or could not be parsed as JSON. Adoption field completeness and pin format are schema-checked here. The observed contracts code (for example SFC1001) is carried in details.observedCode."
+      "meaning": "The descriptor failed the SPI-composed extended profile-descriptor schema under the declared dialect and strict policy, or could not be parsed as JSON. Adoption field completeness and pin format are schema-checked here. The observed contracts code (for example SFC1001) is carried in details.observedCode."
     },
     {
       "code": "SPE1002",
@@ -74,6 +88,11 @@
       "code": "SPE1007",
       "name": "OVERRIDE_POLICY_VIOLATION",
       "meaning": "An overrides entry violates the tightening-only policy: the rule id does not exist in the frozen rule baseline catalog, the parameter is not registered for that rule, the same rule/parameter pair is declared twice, or the numeric value does not strictly tighten the catalog baseline in the parameter's declared direction (relaxation and equality are both refused)."
+    },
+    {
+      "code": "SPE1008",
+      "name": "PROJECT_PROFILE_INVALID",
+      "meaning": "The project-level profile cannot be read, parsed, or validated against the project-profile contract. Pin and override failures retain SPE1006 and SPE1007."
     }
   ],
   "extensionPoints": [

package/profile-spi/index.mjs

@@ -24,7 +24,7 @@ const SPI_DEFINITION = JSON.parse(
   await readFile(new URL("./extension-spi.json", import.meta.url), "utf8"),
 );
 
-// SPI v2 type definitions for the optional `adoption` and `overrides`
+// SPI v3 type definitions for the optional `adoption` and `overrides`
 // descriptor sections (remediation handoff D-8/D-6). The contracts package
 // stays untouched: the loader composes these $defs onto the contracts
 // profile-descriptor schema at load time and validates descriptors against
@@ -47,11 +47,24 @@ const BASE_DESCRIPTOR_SCHEMA = JSON.parse(
   ),
 );
 
+const PROJECT_PROFILE_SCHEMA = JSON.parse(
+  await readFile(
+    new URL("./project-profile.schema.json", import.meta.url),
+    "utf8",
+  ),
+);
+
+export const PROJECT_PROFILE_SCHEMA_ID = PROJECT_PROFILE_SCHEMA.$id;
+
+export function loadProjectProfileSchema() {
+  return structuredClone(PROJECT_PROFILE_SCHEMA);
+}
+
 /** $id of the SPI-composed descriptor schema (distinct from the contracts $id on purpose). */
 export const EXTENDED_DESCRIPTOR_SCHEMA_ID = SPI_DEFINITION.descriptor.extendedSchemaId;
 
 /**
- * Composes the SPI v2 extended descriptor schema: the frozen contracts
+ * Composes the SPI v3 extended descriptor schema: the frozen contracts
  * profile-descriptor schema plus the optional top-level `adoption` and
  * `overrides` sections defined by profiles/spi/profile-adoption.schema.json.
  * Returns a fresh document on every call; callers never mutate it.
@@ -70,7 +83,7 @@ export function loadRuleBaselineCatalog() {
   return RULE_BASELINE_CATALOG;
 }
 
-/** Frozen SPI result codes: SPE0000 plus SPE1001..SPE1007 (SPI v2). */
+/** Frozen SPI result codes: SPE0000 plus SPE1001..SPE1008. */
 export const SPI_RESULT_CODES = Object.freeze(
   Object.fromEntries(SPI_DEFINITION.resultCodes.map((entry) => [entry.code, entry.name])),
 );
@@ -283,7 +296,7 @@ export function assessOverridesPolicy(overrides) {
  * failing step decides the stable result code:
  *
  *   SPE1001 descriptor invalid (schema/parse; carries observedCode). Since
- *           SPI v2 the descriptor is validated against the SPI-composed
+ *           SPI v3 the descriptor is validated against the SPI-composed
  *           extended schema that admits the optional `adoption` and
  *           `overrides` sections; adoption field completeness and pin
  *           format are schema-checked here.
@@ -330,8 +343,8 @@ export async function verifyProfile({ profileRoot, descriptorRelPath } = {}) {
   }
   const validation = validateDocument(descriptor, {
     schema: loadExtendedDescriptorSchema(),
-    dialect: SPI_DEFINITION.descriptor.dialect,
-    policy: SPI_DEFINITION.descriptor.policy,
+    dialect: SPI_DEFINITION.projectProfile.dialect,
+    policy: SPI_DEFINITION.projectProfile.policy,
   });
   if (!validation.valid) {
     return result("SPE1001", {
@@ -459,7 +472,7 @@ export async function verifyProfile({ profileRoot, descriptorRelPath } = {}) {
     }
     const keys = Object.keys(exported).sort();
     const allowed = [...DECLARATION_SHAPE.allowedKeySet].sort();
-    if (keys.join("") !== allowed.join("")) {
+    if (keys.join("\0") !== allowed.join("\0")) {
       return result("SPE1002", {
         profileId,
         reason: "declaration-shape-keys",
@@ -568,6 +581,71 @@ export async function verifyProfile({ profileRoot, descriptorRelPath } = {}) {
   });
 }
 
+/**
+ * Verifies the project-level adoption declaration emitted by scaffold.
+ * This intake is deliberately separate from verifyProfile: a project profile
+ * declares the adopting workspace, while a descriptor declares a provider.
+ */
+export async function verifyProjectProfile({ projectRoot, profileRelPath } = {}) {
+  if (typeof projectRoot !== "string" || projectRoot.length === 0) {
+    throw new TypeError("verifyProjectProfile: projectRoot must be a non-empty path string");
+  }
+  const relPath = profileRelPath ?? "profile.json";
+  const projectSteps = [];
+  let raw;
+  try {
+    raw = await readFileContained(projectRoot, relPath, { encoding: "utf8" });
+  } catch (cause) {
+    return result("SPE1008", { reason: "project-profile-unreadable", details: { kind: cause?.details?.kind ?? "unknown", profile: relPath }, steps: projectSteps });
+  }
+  let document;
+  try {
+    document = JSON.parse(raw);
+  } catch {
+    return result("SPE1008", { reason: "project-profile-parse-failed", details: { profile: relPath }, steps: projectSteps });
+  }
+  const validation = validateDocument(document, {
+    schema: loadProjectProfileSchema(),
+    dialect: SPI_DEFINITION.descriptor.dialect,
+    policy: SPI_DEFINITION.descriptor.policy,
+  });
+  if (!validation.valid) {
+    return result("SPE1008", {
+      reason: "project-profile-schema-invalid",
+      details: { observedCode: validation.errorCode, errors: validation.errors.slice(0, 5) },
+      steps: projectSteps,
+    });
+  }
+  projectSteps.push("project-profile-schema");
+  const projectProfile = validation.data;
+  let digestReport;
+  try {
+    digestReport = await verifyAdoptionDigests({ profileRoot: projectRoot, adoption: projectProfile.adoption });
+  } catch (cause) {
+    return result("SPE1008", { reason: "project-profile-adoption-invalid", details: { message: cause?.message ?? String(cause) }, steps: projectSteps });
+  }
+  if (!digestReport.ok) {
+    const failed = digestReport.results.find((entry) => entry.status !== "verified");
+    return result("SPE1006", {
+      reason: failed.status === "artifact-unreadable" ? "pin-artifact-unreadable" : "pin-digest-mismatch",
+      details: { package: failed.package, path: failed.path, declaredSha256: failed.declaredSha256, actualSha256: failed.actualSha256, containmentKind: failed.containmentKind ?? null },
+      steps: projectSteps,
+    });
+  }
+  projectSteps.push("adoption-pin-digests");
+  const assessment = assessOverridesPolicy(projectProfile.overrides);
+  if (!assessment.ok) {
+    const [finding] = assessment.findings;
+    return result("SPE1007", { reason: finding.kind, details: { ...finding }, steps: projectSteps });
+  }
+  projectSteps.push("overrides-policy");
+  return result("SPE0000", {
+    projectId: projectProfile.project.id,
+    details: { adoptionDeclared: true, overrides: projectProfile.overrides.length },
+    steps: projectSteps,
+  });
+}
+
 /** The frozen SPI definition document. */
 export function loadSpiDefinition() {
   return SPI_DEFINITION;

package/profile-spi/profile-adoption.schema.json

@@ -2,119 +2,14 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://spi.profiles.skill-family.example/v2/profile-adoption.json",
   "title": "ProfileAdoptionAndOverridesSections",
-  "description": "SPI v2 type definitions for the optional top-level `adoption` and `overrides` sections of a profile descriptor (skill-family.profile-descriptor). The adoption declaration is the lightweight adoption proof that replaces the deprecated adoption-lock concept (remediation handoff D-8); overrides carry self-tightening rule declarations that reuse the original rule ids with project-level numeric values (handoff D-6). profiles/spi/index.mjs composes these $defs onto the contracts profile-descriptor schema; the contracts package itself is not modified here.",
+  "description": "SPI v3 forwarding schema for provider descriptor adoption and overrides sections. Shape definitions remain owned by the Contracts profile-adoption-declaration schema.",
   "type": "object",
   "$defs": {
-    "pinnedPackage": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["version", "path", "sha256"],
-      "properties": {
-        "version": {
-          "type": "string",
-          "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$",
-          "description": "Exact pinned version of this Foundation package."
-        },
-        "path": {
-          "type": "string",
-          "pattern": "^[A-Za-z0-9._-]+(/[A-Za-z0-9._-]+)*$",
-          "description": "Relative POSIX path of the pinned artifact inside the profile write set; verifyProfile reads it through the containment layer and compares its real sha256 against the declared digest (GK-4 real-file discipline)."
-        },
-        "sha256": {
-          "type": "string",
-          "pattern": "^[0-9a-f]{64}$",
-          "description": "Declared sha256 hex digest of the pinned artifact bytes."
-        }
-      }
-    },
     "adoption": {
-      "type": "object",
-      "description": "Foundation adoption declaration (minimal D-8 field set). Presence is optional; when present every field is mandatory and mechanically verified by verifyProfile.",
-      "additionalProperties": false,
-      "required": ["foundation_profile", "foundation_pin", "adopted_at"],
-      "properties": {
-        "foundation_profile": {
-          "type": "object",
-          "additionalProperties": false,
-          "required": ["id", "version", "stability"],
-          "properties": {
-            "id": {
-              "type": "string",
-              "pattern": "^[a-z][a-z0-9]*(-[a-z0-9]+)*$",
-              "description": "Stable kebab-case identifier of the adopted Foundation profile."
-            },
-            "version": {
-              "type": "integer",
-              "minimum": 1,
-              "description": "Integer version of the adopted Foundation profile."
-            },
-            "stability": {
-              "enum": ["stable", "candidate-only"],
-              "description": "Stability class of the adopted Foundation profile at adoption time."
-            }
-          }
-        },
-        "foundation_pin": {
-          "type": "object",
-          "description": "Pin of all three Foundation packages (contracts, harness-node, engineering-kit) with exact versions and artifact sha256 digests.",
-          "additionalProperties": false,
-          "required": ["algorithm", "packages"],
-          "properties": {
-            "algorithm": {
-              "const": "sha256",
-              "description": "Digest algorithm; sha256 is the only admitted value."
-            },
-            "packages": {
-              "type": "object",
-              "additionalProperties": false,
-              "required": [
-                "skill-family-contracts",
-                "skill-family-harness-node",
-                "skill-family-engineering-kit"
-              ],
-              "properties": {
-                "skill-family-contracts": { "$ref": "#/$defs/pinnedPackage" },
-                "skill-family-harness-node": { "$ref": "#/$defs/pinnedPackage" },
-                "skill-family-engineering-kit": { "$ref": "#/$defs/pinnedPackage" }
-              }
-            }
-          }
-        },
-        "adopted_at": {
-          "type": "string",
-          "format": "date-time",
-          "description": "RFC 3339 date-time at which the adoption took place."
-        }
-      }
+      "$ref": "https://contracts.skill-family.example/v1/profile-adoption-declaration.json#/$defs/adoption"
     },
     "overrides": {
-      "type": "array",
-      "description": "Self-tightening override declarations (handoff D-6): each entry reuses an existing rule id with a project-level numeric value. Overrides may only tighten the baseline, never relax it; every entry is machine-checked by verifyProfile against the frozen rule baseline catalog (profiles/spi/rule-baseline-catalog.json).",
-      "items": {
-        "type": "object",
-        "additionalProperties": false,
-        "required": ["ruleId", "parameter", "value"],
-        "properties": {
-          "ruleId": {
-            "type": "string",
-            "pattern": "^SFA-[A-Z0-9]+-[0-9]{3}$",
-            "description": "Canonical rule id being tightened (no new rule id is minted; the original id is reused)."
-          },
-          "parameter": {
-            "type": "string",
-            "pattern": "^[a-zA-Z][a-zA-Z0-9]*$",
-            "description": "Named numeric parameter of the rule, as registered in the rule baseline catalog."
-          },
-          "value": {
-            "type": "number",
-            "description": "Project-level override value; must strictly tighten the catalog baseline in the parameter's declared direction."
-          },
-          "note": {
-            "type": "string",
-            "description": "Optional human rationale; not consumed mechanically."
-          }
-        }
-      }
+      "$ref": "https://contracts.skill-family.example/v1/profile-adoption-declaration.json#/$defs/overrides"
     }
   }
 }

package/profile-spi/project-profile.schema.json

@@ -0,0 +1,25 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://contracts.skill-family.example/v1/project-profile.json",
+  "title": "ProjectProfile",
+  "description": "Declares a project's Skill Family adoption and tightening overrides.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "kind", "project", "adoption", "overrides"],
+  "properties": {
+    "schemaVersion": { "const": 1 },
+    "kind": { "const": "skill-family.project-profile" },
+    "project": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "workspace"],
+      "properties": {
+        "id": { "type": "string", "pattern": "^[a-z][a-z0-9]*(-[a-z0-9]+)*$" },
+        "workspace": { "type": "string", "minLength": 1 }
+      }
+    },
+    "adoption": { "$ref": "https://contracts.skill-family.example/v1/profile-adoption-declaration.json#/$defs/adoption" },
+    "overrides": { "$ref": "https://contracts.skill-family.example/v1/profile-adoption-declaration.json#/$defs/overrides" },
+    "note": { "type": "string" }
+  }
+}

package/release-notes/0.8.0.yaml

@@ -0,0 +1,19 @@
+version: 0.8.0
+date: 2026-08-21
+locales:
+  en:
+    summary: Profile SPI v3 adds direct verification for scaffolded Project Profiles while descriptor verification remains stable.
+    changes:
+      added:
+        - Adds verifyProjectProfile({ projectRoot, profileRelPath? }) for skill-family.project-profile declarations.
+        - Keeps verifyProfile descriptor-only and reuses Contracts-owned adoption and overrides field definitions.
+        - Adds SPE1008 PROJECT_PROFILE_INVALID; SPE1006 and SPE1007 retain their existing meanings.
+    upgradeNotes: Project-root consumers must pin engineering-kit 0.8.0 and call verifyProjectProfile. Descriptor consumers continue to call verifyProfile; 0.7.0 remains available.
+  zh-CN:
+    summary: Profile SPI v3 新增 scaffold 项目 Profile 的直接校验，descriptor 校验保持兼容。
+    changes:
+      added:
+        - 新增 verifyProjectProfile({ projectRoot, profileRelPath? })，用于校验 skill-family.project-profile 声明。
+        - verifyProfile 继续只校验 descriptor，并复用 Contracts 拥有的 adoption 与 overrides 字段定义。
+        - 新增 SPE1008 PROJECT_PROFILE_INVALID；SPE1006 与 SPE1007 含义保持不变。
+    upgradeNotes: 项目根消费者必须锁定 engineering-kit 0.8.0 并调用 verifyProjectProfile；descriptor 消费者继续调用 verifyProfile，0.7.0 仍可使用。

package/src/adopt-plan.mjs

@@ -54,12 +54,12 @@ async function readExistingBytes(rootAbs, relPath) {
 }
 
 /**
- * The per-adoption profile draft (SPI v2; remediation handoff C3/D-8).
+ * The per-adoption project profile draft (SPI v3; remediation handoff C3/D-8).
  *
  * Replaces the deprecated ten-field hand-off draft of the adoption-lock
  * era: the adoption-lock concept and its artifact form are abolished, and
  * the lightweight adoption proof is the profile.json descriptor's own
- * adoption declaration, machine-verified by verifyProfile (SPI v2):
+ * adoption declaration, machine-verified by verifyProjectProfile:
  * descriptor-schema completeness of the minimal adoption field set, GK-4
  * real-file digest discipline (SPE1006), and the tightening-only overrides
  * policy (SPE1007).
@@ -100,7 +100,8 @@ export function buildProfileDraft({ inputs, migrationManifest, writeSet, entries
       .map((pkg) => [pkg.name, pkg]),
   );
   const loadedVersions = Object.freeze({
-    "skill-family-contracts": CONTRACTS_VERSION,
+    "skill-family-contracts": KIT_VERSION,
+    "skill-family-harness-node": KIT_VERSION,
     "skill-family-engineering-kit": KIT_VERSION,
   });
   const packages = {};
@@ -114,7 +115,7 @@ export function buildProfileDraft({ inputs, migrationManifest, writeSet, entries
     packages[name] = { version, path: null, sha256: null };
   }
 
-  incompleteFields.push("descriptor.profile.version", "adoption.adopted_at");
+  incompleteFields.push("adoption.adopted_at");
 
   // Binding digests: the target file-set summary and the Foundation plan.
   const targetSetDigest = digestBytes(
@@ -124,31 +125,30 @@ export function buildProfileDraft({ inputs, migrationManifest, writeSet, entries
     Buffer.from(writeSet.map((item) => `${item.path}:${item.action}:${item.sha256}`).sort().join("\n"), "utf8"),
   );
 
-  return {
-    kind: "skill-family.profile-draft",
+  const projectProfile = {
     schemaVersion: 1,
-    descriptorRelPath: "profile.json",
-    descriptor: {
-      schemaVersion: 1,
-      kind: "skill-family.profile-descriptor",
-      profile: { id: inputs.projectId, name: inputs.projectName, version: null },
-      base: { contractsVersion: CONTRACTS_VERSION },
-      differences: [],
-      spi: [],
-      adoption: {
-        foundation_profile: foundationProfile,
-        foundation_pin: { algorithm: "sha256", packages },
-        adopted_at: null,
-      },
-      overrides: [],
+    kind: "skill-family.project-profile",
+    project: { id: inputs.projectId, workspace: `${inputs.projectId}-workspace` },
+    adoption: {
+      foundation_profile: foundationProfile,
+      foundation_pin: { algorithm: "sha256", packages },
+      adopted_at: null,
     },
+    overrides: [],
+  };
+
+  return {
+    kind: "skill-family.project-profile-draft",
+    schemaVersion: 1,
+    profileRelPath: "profile.json",
+    projectProfile,
     overridesGuidance:
-      "overrides stays empty by default. An override is admissible only when it reuses an existing rule id with a project-level numeric value that strictly tightens the frozen rule baseline catalog in the parameter's declared direction (not-increase: strictly less; not-decrease: strictly greater). Equality and relaxation are refused (SPI v2 SPE1007); risk identification for misuse of tightening belongs to skill-failure-auditor, not to this mechanical check.",
+      "overrides stays empty by default. An override is admissible only when it reuses an existing rule id with a project-level numeric value that strictly tightens the frozen rule baseline catalog in the parameter's declared direction (not-increase: strictly less; not-decrease: strictly greater). Equality and relaxation are refused (SPE1007); risk identification for misuse of tightening belongs to skill-failure-auditor, not to this mechanical check.",
     incompleteFields,
     ready: incompleteFields.length === 0,
     binding: { targetSetDigest, foundationPlanDigest },
     policyNote:
-      "adoption-lock is deprecated (remediation handoff D-8): the kit no longer produces adoption-lock-form artifacts. The adoption proof is this descriptor's adoption declaration, completed with real artifact paths and digests inside the profile write set and machine-verified by verifyProfile (SPI v2: SPE1006 digest discipline, SPE1007 tightening-only overrides).",
+      "adoption-lock is deprecated (remediation handoff D-8): the kit no longer produces adoption-lock-form artifacts. The adoption proof is this project's adoption declaration, completed with real artifact paths and digests inside the profile write set and machine-verified by verifyProjectProfile (SPE1006 digest discipline, SPE1007 tightening-only overrides).",
   };
 }
 

package/src/skeleton.mjs

@@ -398,9 +398,9 @@ function renderProjectProfile({ projectId, profileId }) {
       foundation_pin: {
         algorithm: "sha256",
         packages: {
-          "skill-family-contracts": { version: CONTRACTS_VERSION, path: null, sha256: null },
+          "skill-family-contracts": { version: KIT_VERSION, path: null, sha256: null },
           "skill-family-engineering-kit": { version: KIT_VERSION, path: null, sha256: null },
-          "skill-family-harness-node": { version: null, path: null, sha256: null },
+          "skill-family-harness-node": { version: KIT_VERSION, path: null, sha256: null },
         },
       },
       adopted_at: null,
@@ -413,7 +413,7 @@ function renderProjectProfile({ projectId, profileId }) {
         note: "示例覆盖：项目自加严词元告警阈值（基线 2000，取值必须严格小于基线）。覆盖只允许更严、不允许放松；每条覆盖都是可机器校验的声明，按冻结的规则基线目录（rule-baseline-catalog.json）核验。",
       },
     ],
-    note: "采用声明与自加严覆盖由项目自行维护；engineering kit 只种子化模板，永不覆盖。null 字段必须由项目以真实事实补齐后才构成有效声明：foundation_profile.version/stability 是人的决策；foundation_pin.packages.*.path/sha256 必须从项目写集内真实钉扎工件的字节计算（GK-4 摘要纪律）；adopted_at 是完成采用的 RFC 3339 时间。本文件是项目级声明（kind skill-family.project-profile），不是 Profile SPI descriptor；adoption/overrides 段的形状与 SPI v2 权威定义（profiles/spi/profile-adoption.schema.json）逐字段一致。",
+    note: "采用声明与自加严覆盖由项目自行维护；engineering kit 只种子化模板，永不覆盖。null 字段必须由项目以真实事实补齐后才构成有效声明：foundation_profile.version/stability 是人的决策；foundation_pin.packages.*.path/sha256 必须从项目写集内真实钉扎工件的字节计算（GK-4 摘要纪律）；adopted_at 是完成采用的 RFC 3339 时间。本文件是项目级声明（kind skill-family.project-profile），不是 Profile SPI descriptor；adoption/overrides 段的形状与 SPI v3 权威定义（Contracts profile-adoption-declaration 的 $defs）逐字段一致。",
   });
 }