skill-family-engineering-kit 0.7.0 → 0.8.1

package/CHANGELOG.md

@@ -1,5 +1,42 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.8.1 locale=en baseline=sha256:e22f9a90f4275671e77a23aeee6ee036ab5c4c5a041a9ed9a144d055ce886da5 -->
+## [0.8.1] - 2026-08-22
+
+Engineering Kit now preserves its own package version when a host bundles it into a single-file adapter.
+
+### Changed
+
+- Moves Contracts, Harness, and Engineering Kit together to version 0.8.1; the Contracts 1.7.0 and Profile SPI v3 surfaces remain unchanged.
+
+### Fixed
+
+- Replaces the runtime import.meta.url package-manifest lookup with a static JSON import, so source and installed-package execution still read the Kit manifest while esbuild inlines the same version into a host bundle.
+- Adds a regression test that bundles Engineering Kit as a third-party dependency into one host entry file, runs it outside the package tree, and verifies the reported version against the package manifest.
+
+### Upgrade Notes
+
+Host adapters that bundle Engineering Kit must pin 0.8.1. Source and ordinary installed-package consumers keep the existing API and require no migration.
+<!-- release-skill:changelog:end version=0.8.1 locale=en -->
+
+
+<!-- release-skill:changelog:start version=0.8.0 locale=en baseline=sha256:47377b52339e57d0087ffdff72ba04f88d8dd290f5a6e472fc67eb9a801007db -->
+## [0.8.0] - 2026-08-21
+
+Profile SPI v3 adds direct verification for scaffolded Project Profiles while descriptor verification remains stable.
+
+### Added
+
+- Adds verifyProjectProfile({ projectRoot, profileRelPath? }) for skill-family.project-profile declarations.
+- Keeps verifyProfile descriptor-only and reuses Contracts-owned adoption and overrides field definitions.
+- Adds SPE1008 PROJECT_PROFILE_INVALID; SPE1006 and SPE1007 retain their existing meanings.
+
+### Upgrade Notes
+
+Project-root consumers must pin engineering-kit 0.8.0 and call verifyProjectProfile. Descriptor consumers continue to call verifyProfile; 0.7.0 remains available.
+<!-- release-skill:changelog:end version=0.8.0 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.7.0 locale=en baseline=sha256:ed1c59e7cee6e7280d2569e554b07d3b3513f4f3318bf30e374e2d480320f2b7 -->
 ## [0.7.0] - 2026-08-21
 

package/CHANGELOG.zh-CN.md

@@ -1,5 +1,42 @@
 # 变更日志
 
+<!-- release-skill:changelog:start version=0.8.1 locale=zh-CN baseline=sha256:67ed1129fc865709a1205d34c82521a6c7a7f6d9a914c0c400c21ad2767a841b -->
+## [0.8.1] - 2026-08-22
+
+宿主把 Engineering Kit 打包进单文件适配器后，Kit 仍能保留自身的包版本。
+
+### 变更
+
+- Contracts、Harness 与 Engineering Kit 一同升至 0.8.1；Contracts 1.7.0 与 Profile SPI v3 表面保持不变。
+
+### 修复
+
+- 用静态 JSON import 替换运行时基于 import.meta.url 的包清单查找。源码与普通安装包仍读取 Kit 自身清单，esbuild 则把同一版本值内联到宿主 bundle。
+- 新增回归测试：把 Engineering Kit 作为第三方依赖打包成单一宿主入口，在包目录之外运行，并用包清单复核其报告版本。
+
+### 升级说明
+
+把 Engineering Kit 打包进宿主适配器的消费者必须精确锁定 0.8.1；源码和普通安装包消费者沿用现有 API，不需要迁移。
+<!-- release-skill:changelog:end version=0.8.1 locale=zh-CN -->
+
+
+<!-- release-skill:changelog:start version=0.8.0 locale=zh-CN baseline=sha256:0d8fb108ec3e89d5c6b6bea39fc6767a0e1c198546d243d86a963fc5855ed4a9 -->
+## [0.8.0] - 2026-08-21
+
+Profile SPI v3 新增 scaffold 项目 Profile 的直接校验，descriptor 校验保持兼容。
+
+### 新增
+
+- 新增 verifyProjectProfile({ projectRoot, profileRelPath? })，用于校验 skill-family.project-profile 声明。
+- verifyProfile 继续只校验 descriptor，并复用 Contracts 拥有的 adoption 与 overrides 字段定义。
+- 新增 SPE1008 PROJECT_PROFILE_INVALID；SPE1006 与 SPE1007 含义保持不变。
+
+### 升级说明
+
+项目根消费者必须锁定 engineering-kit 0.8.0 并调用 verifyProjectProfile；descriptor 消费者继续调用 verifyProfile，0.7.0 仍可使用。
+<!-- release-skill:changelog:end version=0.8.0 locale=zh-CN -->
+
+
 <!-- release-skill:changelog:start version=0.7.0 locale=zh-CN baseline=sha256:e6070267ab3db289caf998c4539055c3d39dfa16fb5bc7db44689b305fde2e81 -->
 ## [0.7.0] - 2026-08-21
 

package/README.md

@@ -4,28 +4,27 @@
 
 # skill-family-engineering-kit
 
-<!-- release-skill:release-version: 0.7.0 -->
+<!-- release-skill:release-version: 0.8.1 -->
 
 An engineering toolkit used in development and CI. There are **exactly four** top-level commands, and no fifth:
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.7.0** (2026-08-21)
+**0.8.1** (2026-08-22)
 
-This release exports the public canonical projection closure builder buildProjectionClosure (FG-4), so callers construct compileProjectionPlan-ready plan closures through one public entry instead of re-implementing the Kit-private ordering, serialization, and digest algorithms.
+Engineering Kit now preserves its own package version when a host bundles it into a single-file adapter.
 
-**Added**
+**Changed**
 
-- Adds the public skill-family-engineering-kit/profile-spi subpath. It projects the three Profile SPI JSON resources together with the Contracts canonical profile-descriptor.schema.json, and exports schema loaders, verifyProfile, adoption-pin verification, and tightening-only override checks. The data-only verifier fails closed on missing pins and symlink/path escapes and never executes Profile entrypoints.
-- Adds buildProjectionClosure - a pure public builder accepting an array of {path, sha256, mode} members (an explicit type file is also accepted) and returning the canonical plan closure {digestAlgorithm sha256, digest, resourceCount, resources} that compileProjectionPlan accepts verbatim as previousOwnedClosure or externalCandidateClosure; an empty array yields the legal empty closure.
-- The builder shares one normalization and digest source of truth with the compiler closure re-verification - deterministic path.localeCompare ordering, duplicate-path and portable-collision refusal, and the sha256(JSON.stringify(normalizedResources)) byte contract; every refusal fails closed in the existing projection plan input invalid domain (SFC2004 invalid-manifest).
+- Moves Contracts, Harness, and Engineering Kit together to version 0.8.1; the Contracts 1.7.0 and Profile SPI v3 surfaces remain unchanged.
 
-**Changed**
+**Fixed**
 
-- Keeps the compileProjectionPlan input contract unchanged and the four top-level commands (scaffold, adopt-plan, projection, check) unchanged; every 0.6.0 input still compiles to byte-identical plans. The package version moves in lockstep with the Foundation line while the contracts machine contract stays at 1.6.0.
+- Replaces the runtime import.meta.url package-manifest lookup with a static JSON import, so source and installed-package execution still read the Kit manifest while esbuild inlines the same version into a host bundle.
+- Adds a regression test that bundles Engineering Kit as a third-party dependency into one host entry file, runs it outside the package tree, and verifies the reported version against the package manifest.
 
 **Upgrade Notes**
 
-Version 0.7.0 is the projection closure builder line. Callers that previously assembled plan closures locally must import buildProjectionClosure and pin exactly 0.7.0. A plan closure ({path, type, sha256, mode} members) is not the harness computeResourceClosure resource closure ({path, role, exists, sha256} members) - the two shapes and purposes differ and are not interchangeable.
+Host adapters that bundle Engineering Kit must pin 0.8.1. Source and ordinary installed-package consumers keep the existing API and require no migration.
 <!-- release-skill:managed:end id=latest-release -->
 
 | Command | Purpose | Side effects |
@@ -46,7 +45,7 @@ Kit is the "engineering stage" layer, depending on the Harness and Contracts. It
 ## Installation and Minimal Example
 
 ```sh
-npm install --save-dev skill-family-engineering-kit@0.7.0
+npm install --save-dev skill-family-engineering-kit@0.8.1
 npm exec -- skill-family-kit --help
 npm exec -- skill-family-kit scaffold --root <empty-dir> --project-id my-project
 npm exec -- skill-family-kit adopt-plan --root <repo>
@@ -54,15 +53,15 @@ npm exec -- skill-family-kit projection --root <repo>
 npm exec -- skill-family-kit check --root <repo>
 ```
 
-The four commands above cover skeleton generation, read-only inventory, managed projection, and diagnostics respectively; a zero-install form is available via `npm exec --package=skill-family-engineering-kit@0.7.0 -- skill-family-kit --help`.
+The four commands above cover skeleton generation, read-only inventory, managed projection, and diagnostics respectively; a zero-install form is available via `npm exec --package=skill-family-engineering-kit@0.8.1 -- skill-family-kit --help`.
 
 ### Public Profile SPI
 
-The `skill-family-engineering-kit/profile-spi` subpath exposes the stable Profile SPI v2 data surface. It exports `verifyProfile`, `verifyAdoptionDigests`, `assessOverridesPolicy`, `loadSpiDefinition`, `loadExtendedDescriptorSchema`, and `loadRuleBaselineCatalog`.
+The `skill-family-engineering-kit/profile-spi` subpath exposes the stable Profile SPI v3 data surface. It exports `verifyProfile`, `verifyProjectProfile`, `verifyAdoptionDigests`, `assessOverridesPolicy`, `loadSpiDefinition`, `loadExtendedDescriptorSchema`, `loadProjectProfileSchema`, and `loadRuleBaselineCatalog`. Contracts `profile-adoption-declaration` owns the adoption and overrides field shapes; the SPI `profile-adoption.schema.json` path remains only as a compatibility forwarding path.
 
 The package carries three SPI JSON resources and the Contracts canonical `profile-descriptor.schema.json`. `profiles/spi` is the only handwritten source; projen mechanically projects those resources and the module into this subpath. The projection changes only the two public package imports and the local schema URL.
 
-`verifyProfile({ profileRoot })` is read-only and data-only. It refuses descriptor errors, missing resources, executable entrypoints, symlink/path escapes, core reverse dependencies, unverified adoption pins, and non-tightening overrides with stable `SPE0000` / `SPE1001`–`SPE1007` result codes. It never executes Profile-provided files. The Profile's domain meaning remains owned by the caller.
+`verifyProfile({ profileRoot })` is read-only and data-only for Profile descriptors. `verifyProjectProfile({ projectRoot, profileRelPath? })` is the corresponding entry for a project root declaration. Both refuse invalid input with stable result codes, never execute Profile-provided files, and leave Profile domain meaning to the caller.
 
 ### Report sub-action
 

package/README.zh-CN.md

@@ -5,28 +5,27 @@
 
 # skill-family-engineering-kit
 
-<!-- release-skill:release-version: 0.7.0 -->
+<!-- release-skill:release-version: 0.8.1 -->
 
 开发与 CI 阶段使用的工程工具包。**恰好四个**顶层命令，没有第五个：
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.7.0** (2026-08-21)
+**0.8.1** (2026-08-22)
 
-本版导出公共规范投影闭包 builder buildProjectionClosure（FG-4），调用方经一个公共入口即可构造 compileProjectionPlan 可直接接受的计划闭包，不再复刻 Kit 私有的排序、序列化与摘要算法。
+宿主把 Engineering Kit 打包进单文件适配器后，Kit 仍能保留自身的包版本。
 
-**新增**
+**变更**
 
-- 新增公共 skill-family-engineering-kit/profile-spi 子路径。它投影三个 Profile SPI JSON 资源与 Contracts canonical profile-descriptor.schema.json，导出 Schema 加载器、verifyProfile、采用 pin 校验和只收紧 overrides 检查。纯数据校验器遇到 pin 缺失、符号链接或路径越界时失败关闭，绝不执行 Profile entrypoint。
-- 新增 buildProjectionClosure：纯函数公共 builder，接受 {path, sha256, mode} 成员数组（可接受显式 type file），返回规范计划闭包 {digestAlgorithm sha256, digest, resourceCount, resources}，可原样作为 compileProjectionPlan 的 previousOwnedClosure 或 externalCandidateClosure；空数组返回合法的空闭包。
-- builder 与编译器闭包复验共享同一规范化与摘要事实源：确定性 path.localeCompare 排序、重复路径与便携路径冲突拒绝、sha256(JSON.stringify(normalizedResources)) 字节合同；全部拒绝在既有 projection plan input invalid 领域内失败关闭（SFC2004 invalid-manifest）。
+- Contracts、Harness 与 Engineering Kit 一同升至 0.8.1；Contracts 1.7.0 与 Profile SPI v3 表面保持不变。
 
-**变更**
+**修复**
 
-- compileProjectionPlan 入参合同不变，四个顶层命令（scaffold、adopt-plan、projection、check）不变；全部 0.6.0 既有输入仍编译为字节不变的计划。包版本随 Foundation 线锁步，Contracts 机器合同保持 1.6.0。
+- 用静态 JSON import 替换运行时基于 import.meta.url 的包清单查找。源码与普通安装包仍读取 Kit 自身清单，esbuild 则把同一版本值内联到宿主 bundle。
+- 新增回归测试：把 Engineering Kit 作为第三方依赖打包成单一宿主入口，在包目录之外运行，并用包清单复核其报告版本。
 
 **升级说明**
 
-0.7.0 是投影闭包 builder 线。此前在本地组装计划闭包的调用方必须导入 buildProjectionClosure 并精确锁定 0.7.0。计划闭包（成员 {path, type, sha256, mode}）不是 harness computeResourceClosure 的资源闭包（成员 {path, role, exists, sha256}）——两者形状与用途不同，不能互换。
+把 Engineering Kit 打包进宿主适配器的消费者必须精确锁定 0.8.1；源码和普通安装包消费者沿用现有 API，不需要迁移。
 <!-- release-skill:managed:end id=latest-release -->
 
 | 命令 | 用途 | 副作用 |
@@ -47,7 +46,7 @@ Kit 是「工程阶段」层，依赖 Harness 与 Contracts。它只做四件事
 ## 安装和最小示例
 
 ```sh
-npm install --save-dev skill-family-engineering-kit@0.7.0
+npm install --save-dev skill-family-engineering-kit@0.8.1
 npm exec -- skill-family-kit --help
 npm exec -- skill-family-kit scaffold --root <empty-dir> --project-id my-project
 npm exec -- skill-family-kit adopt-plan --root <repo>
@@ -55,15 +54,15 @@ npm exec -- skill-family-kit projection --root <repo>
 npm exec -- skill-family-kit check --root <repo>
 ```
 
-以上四条命令分别覆盖生成骨架、只读盘点、受管投影与诊断；零安装形式可用 `npm exec --package=skill-family-engineering-kit@0.7.0 -- skill-family-kit --help`。
+以上四条命令分别覆盖生成骨架、只读盘点、受管投影与诊断；零安装形式可用 `npm exec --package=skill-family-engineering-kit@0.8.1 -- skill-family-kit --help`。
 
 ### 公共 Profile SPI
 
-`skill-family-engineering-kit/profile-spi` 子路径提供稳定的 Profile SPI v2 数据表面，导出 `verifyProfile`、`verifyAdoptionDigests`、`assessOverridesPolicy`、`loadSpiDefinition`、`loadExtendedDescriptorSchema` 与 `loadRuleBaselineCatalog`。
+`skill-family-engineering-kit/profile-spi` 子路径提供稳定的 Profile SPI v3 数据表面，导出 `verifyProfile`、`verifyProjectProfile`、`verifyAdoptionDigests`、`assessOverridesPolicy`、`loadSpiDefinition`、`loadExtendedDescriptorSchema`、`loadProjectProfileSchema` 与 `loadRuleBaselineCatalog`。adoption 与 overrides 的字段形状由 Contracts `profile-adoption-declaration` 唯一拥有；SPI 的 `profile-adoption.schema.json` 路径仅保留为兼容转发表。
 
 包内携带三个 SPI JSON 资源与 Contracts canonical `profile-descriptor.schema.json`。`profiles/spi` 是唯一手写真源；projen 将这些资源和模块机械投影到该子路径。投影只修改两个公共包导入和一个本地 Schema URL。
 
-`verifyProfile({ profileRoot })` 只读处理纯数据。遇到 descriptor 错误、资源缺失、可执行 entrypoint、符号链接或路径越界、反向依赖公共核心、未验证的采用 pin、未收紧的 overrides 时，以稳定 `SPE0000` / `SPE1001`–`SPE1007` 结果码失败关闭；它不会执行 Profile 提供的文件。Profile 的领域含义仍由调用方负责。
+`verifyProfile({ profileRoot })` 只读处理 Profile descriptor；项目根声明使用对应的 `verifyProjectProfile({ projectRoot, profileRelPath? })`。两个入口遇到无效输入都以稳定结果码失败关闭，不会执行 Profile 提供的文件；Profile 的领域含义仍由调用方负责。
 
 ### 报告子动作
 

package/docs/architecture/index.html

@@ -2077,12 +2077,12 @@ Contracts（结构、协议、错误码、协议名登记）
 <p>三包结构保持、不拆第四包（FND-ADR-007）；制品治理采用 artifact-graph CLI 与版本锁（FND-ADR-006）。</p>
 <h2 id="首版预算">首版预算<a class="headerlink" href="#首版预算" title="Permanent link">&para;</a></h2>
 <ul>
-<li>顶层 Contracts 对象：30 类（完整清单以 <code>packages/skill-family-contracts/src/registry.json</code> 为唯一真源）：project-manifest、profile-descriptor、managed-file-lock、operation-request、operation-result、migration-manifest、adapter-source、report-model、report-binding、host-descriptor、host-registry、host-capability-fact、host-probe-result、adapter-build-manifest、host-operation-plan、host-operation-receipt、state-event-envelope、state-snapshot-metadata、token-estimate-result、surface-scan-policy、declared-read-surface-result、structured-scan-policy（FND-ADR-010/011）、timeout-policy、watchdog-termination-envelope（FND-ADR-012，append-only 保持 1.5.0）、public-boundary-declaration、platform-difference-registry、observation-scope、profile-adoption-declaration、audit-baseline-pin、token-estimate-record（审计规则裁决与整改 1.6.0 纳入）；</li>
+<li>顶层 Contracts 对象：31 类（完整清单以 <code>packages/skill-family-contracts/src/registry.json</code> 为唯一真源）：project-manifest、profile-descriptor、project-profile（FND-ADR-013，1.7.0 纳入）、managed-file-lock、operation-request、operation-result、migration-manifest、adapter-source、report-model、report-binding、host-descriptor、host-registry、host-capability-fact、host-probe-result、adapter-build-manifest、host-operation-plan、host-operation-receipt、state-event-envelope、state-snapshot-metadata、token-estimate-result、surface-scan-policy、declared-read-surface-result、structured-scan-policy（FND-ADR-010/011）、timeout-policy、watchdog-termination-envelope（FND-ADR-012，append-only 保持 1.5.0）、public-boundary-declaration、platform-difference-registry、observation-scope、profile-adoption-declaration、audit-baseline-pin、token-estimate-record（审计规则裁决与整改 1.6.0 纳入）；</li>
 <li>Kit 顶层命令：4 个（scaffold、adopt-plan、projection、check）；</li>
 <li>强制机械规则：当前 9 条，预算不超过 20 条，绝对上限 30 条；CR-001 对登记表内全部 Schema 做统一编译；</li>
 <li>叶子包：3 个（skill-family-contracts、skill-family-harness-node、skill-family-engineering-kit）；</li>
 <li>Schema 校验器：Ajv 8.20.0（精确版本 pin），支持 draft-07 与 2020-12 双方言；</li>
-<li>kernel 协议：skill-family.kernel.operation（stable），Contracts 版本 1.6.0；</li>
+<li>kernel 协议：skill-family.kernel.operation（stable），Contracts 版本 1.7.0；</li>
 <li>默认运行时语言：Node；第二语言实现首版为 0。</li>
 </ul>
 <p>任何新增组件必须说明删除它会导致的两个以上真实消费者重复实现，并通过独立 fixture 验证。</p>

package/docs/integration/audit/index.html

@@ -1796,7 +1796,8 @@
   isolation-and-lockfile.md     隔离安装与包锁验证设计
   independence.md               独立性声明与机械证明
   schemas/audit-evidence.schema.json   证据文档的 JSON Schema（审计自有）
-  baseline/contracts-1.6.0.pin.json    Contracts 1.6.0 现行基线 pin（摘要+事实）
+  baseline/contracts-1.7.0.pin.json    Contracts 1.7.0 当前候选基线 pin（摘要+事实）
+  baseline/contracts-1.6.0.pin.json    Contracts 1.6.0 只读兼容存档 pin
   baseline/contracts-1.5.0.pin.json    Contracts 1.5.0 只读兼容存档 pin
   baseline/contracts-1.1.1.pin.json    Contracts 1.1.1 只读兼容存档 pin
   baseline/contracts-1.1.0.pin.json    Contracts 1.1.0 只读兼容存档 pin

package/docs/integration/audit/version-compatibility/index.html

@@ -1791,7 +1791,7 @@
 <tbody>
 <tr>
 <td><code>contractsVersion</code></td>
-<td>Contracts 冻结版本（当前 <code>1.6.0</code>）</td>
+<td>Contracts 冻结版本（当前 <code>1.7.0</code>）</td>
 <td>机器契约内容的版本</td>
 </tr>
 <tr>
@@ -1806,7 +1806,7 @@
 </tr>
 </tbody>
 </table>
-<p>三者都由 <code>describeAuditSurface()</code> 一次性给出，审计侧把它们与基线 pin（当前为 <code>baseline/contracts-1.6.0.pin.json</code>）比对。</p>
+<p>三者都由 <code>describeAuditSurface()</code> 一次性给出，审计侧把它们与基线 pin（当前为 <code>baseline/contracts-1.7.0.pin.json</code>）比对。</p>
 <h2 id="兼容规则">兼容规则<a class="headerlink" href="#兼容规则" title="Permanent link">&para;</a></h2>
 <p>一个被消费的 Contracts 包与某个基线 pin <strong>兼容</strong>，当且仅当同时满足：</p>
 <ol>
@@ -1863,7 +1863,8 @@
 <li><strong>Contracts 1.3.0（2026-08-09）</strong>：宿主接入能力线增量，不是描述补丁：新增 <code>host-descriptor</code>、<code>host-capability-fact</code>、<code>adapter-build-manifest</code>、<code>host-operation-plan</code>、<code>host-operation-receipt</code> 五个顶层契约，改变了公开机器合同与审计事实。</li>
 <li><strong>Contracts 1.4.0（2026-08-09）</strong>：持久状态能力线增量，不是描述补丁：新增 <code>state-event-envelope</code>、<code>state-snapshot-metadata</code> 两个顶层契约，改变了公开机器合同与审计事实。</li>
 <li><strong>Contracts 1.5.0（2026-08-16）</strong>：FND-ADR-010/011 能力线增量，不是描述补丁：新增 <code>declared-read-surface-result</code>、<code>structured-scan-policy</code> 两个顶层契约（顶层对象集合 20 → 22），改变了公开机器合同与审计事实。该 pin 的摘要与事实均从当前 <code>describeAuditSurface()/digestAuditSurface()</code> 机械投影，provenance 仍为 <code>product-compatibility-fixture</code>。</li>
-<li><strong>Contracts 1.6.0（2026-08-18）</strong>：审计整改 C5 能力线增量，不是描述补丁：新增 <code>public-boundary-declaration</code>、<code>platform-difference-registry</code>、<code>observation-scope</code>、<code>profile-adoption-declaration</code>、<code>audit-baseline-pin</code>、<code>token-estimate-record</code> 六个顶层契约（顶层对象集合 24 → 30），改变了公开机器合同与审计事实；未新增 SFC 错误码，规则与 kernel 协议仅随 <code>contractsVersion</code> 字段更新。<code>contracts-1.6.0.pin.json</code> 是当前现行基线（经 <code>scripts/baseline-pin-gen.mjs --update</code> 由 <code>describeAuditSurface()/describeBaselinePin()</code> 机械生成，落盘前经 audit-baseline-pin 合同校验与 <code>verifyBaselinePin()</code> 自校验）；1.5.0 及更早 pin 保留为只读兼容存档。pin 合同本身（<code>audit-baseline-pin</code>）与消费面校验函数 <code>verifyBaselinePin()</code>（AUD-BASE-001 / AUD-LOCK-001 编码）在本版本落地（GAP-5 / SG-28）。</li>
+<li><strong>Contracts 1.6.0（2026-08-18）</strong>：审计整改 C5 能力线增量，不是描述补丁：新增 <code>public-boundary-declaration</code>、<code>platform-difference-registry</code>、<code>observation-scope</code>、<code>profile-adoption-declaration</code>、<code>audit-baseline-pin</code>、<code>token-estimate-record</code> 六个顶层契约（顶层对象集合 24 → 30），改变了公开机器合同与审计事实；未新增 SFC 错误码，规则与 kernel 协议仅随 <code>contractsVersion</code> 字段更新。pin 合同本身（<code>audit-baseline-pin</code>）与消费面校验函数 <code>verifyBaselinePin()</code>（AUD-BASE-001 / AUD-LOCK-001 编码）在本版本落地（GAP-5 / SG-28）。</li>
+<li><strong>Contracts 1.7.0（2026-08-22）</strong>：FND-ADR-013 的 Project Profile 能力线增量。新增 <code>project-profile</code> 顶层契约（顶层对象集合 30 → 31），统一 scaffold 项目根声明的机器结构；未新增 SFC 错误码。<code>contracts-1.7.0.pin.json</code> 是当前候选基线，由 <code>scripts/baseline-pin-gen.mjs --update</code> 从 <code>describeAuditSurface()/describeBaselinePin()</code> 机械生成，并经过合同校验和 <code>verifyBaselinePin()</code> 自校验。1.6.0 及更早 pin 保留为只读兼容存档。</li>
 <li>审计运行时先做包锁验证（见 isolation-and-lockfile.md），再做变异重放；pin 不匹配时，变异重放结果不得被采信。</li>
 </ul>
 <h2 id="profile-行为变更纪律2026-08-19D6">profile 行为变更纪律（2026-08-19，D6）<a class="headerlink" href="#profile-行为变更纪律2026-08-19D6" title="Permanent link">&para;</a></h2>

package/docs/public/status/index.html

@@ -1792,17 +1792,17 @@
 <tbody>
 <tr>
 <td><code>skill-family-contracts</code></td>
-<td>0.7.0</td>
+<td>0.8.1</td>
 <td><a href="https://github.com/ifoohoo/skill-family-contracts">ifoohoo/skill-family-contracts</a></td>
 </tr>
 <tr>
 <td><code>skill-family-harness-node</code></td>
-<td>0.7.0</td>
+<td>0.8.1</td>
 <td><a href="https://github.com/ifoohoo/skill-family-harness-node">ifoohoo/skill-family-harness-node</a></td>
 </tr>
 <tr>
 <td><code>skill-family-engineering-kit</code></td>
-<td>0.7.0</td>
+<td>0.8.1</td>
 <td><a href="https://github.com/ifoohoo/skill-family-engineering-kit">ifoohoo/skill-family-engineering-kit</a></td>
 </tr>
 </tbody>