skill-family-engineering-kit 0.8.0 → 0.8.2

package/CHANGELOG.md

@@ -1,5 +1,45 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.8.2 locale=en baseline=sha256:cebfcfd816f8fd5824135d2681f443e5b226d65096bb6f6a9360f6b3bba34fc1 -->
+## [0.8.2] - 2026-08-23
+
+Managed offline Bundles now carry the strict-read source required by the fixed candidate mechanism bridge.
+
+### Added
+
+- Projects strict-read.mjs into the managed Bundle and maps its closure, errors, and paths dependencies to sibling runtime modules.
+- Records the real strict-read.mjs source in Foundation provenance and verifies the read-file-strict bridge in an offline runner.
+
+### Changed
+
+- Moves the package version to 0.8.2 together with Contracts and Harness; the four stable top-level Kit commands remain unchanged.
+
+### Upgrade Notes
+
+Consumers must pin Contracts, Harness, and Engineering Kit to exactly 0.8.2 and rebuild the managed Bundle. Existing Bundles do not gain read-file-strict by changing a worktree reference.
+<!-- release-skill:changelog:end version=0.8.2 locale=en -->
+
+
+<!-- release-skill:changelog:start version=0.8.1 locale=en baseline=sha256:e22f9a90f4275671e77a23aeee6ee036ab5c4c5a041a9ed9a144d055ce886da5 -->
+## [0.8.1] - 2026-08-22
+
+Engineering Kit now preserves its own package version when a host bundles it into a single-file adapter.
+
+### Changed
+
+- Moves Contracts, Harness, and Engineering Kit together to version 0.8.1; the Contracts 1.7.0 and Profile SPI v3 surfaces remain unchanged.
+
+### Fixed
+
+- Replaces the runtime import.meta.url package-manifest lookup with a static JSON import, so source and installed-package execution still read the Kit manifest while esbuild inlines the same version into a host bundle.
+- Adds a regression test that bundles Engineering Kit as a third-party dependency into one host entry file, runs it outside the package tree, and verifies the reported version against the package manifest.
+
+### Upgrade Notes
+
+Host adapters that bundle Engineering Kit must pin 0.8.1. Source and ordinary installed-package consumers keep the existing API and require no migration.
+<!-- release-skill:changelog:end version=0.8.1 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.8.0 locale=en baseline=sha256:47377b52339e57d0087ffdff72ba04f88d8dd290f5a6e472fc67eb9a801007db -->
 ## [0.8.0] - 2026-08-21
 

package/CHANGELOG.zh-CN.md

@@ -1,5 +1,45 @@
 # 变更日志
 
+<!-- release-skill:changelog:start version=0.8.2 locale=zh-CN baseline=sha256:620f03e3fc81c1ef06d23b99fb0e70e547d58f3c6e956691b9c4a05e1b517c3b -->
+## [0.8.2] - 2026-08-23
+
+受管离线 Bundle 现在携带固定候选机制桥接所需的 strict-read 源码。
+
+### 新增
+
+- 把 strict-read.mjs 投影进受管 Bundle，并把它的 closure、errors 和 paths 依赖映射到相邻运行时模块。
+- 在 Foundation provenance 中记录真实 strict-read.mjs 源码，并通过离线 runner 复验 read-file-strict。
+
+### 变更
+
+- 包版本与 Contracts、Harness 一同升至 0.8.2；Kit 的四个稳定顶层命令保持不变。
+
+### 升级说明
+
+消费者必须把 Contracts、Harness 和 Engineering Kit 精确锁定到 0.8.2，再重建受管 Bundle。修改工作树引用不会让已有 Bundle 获得 read-file-strict。
+<!-- release-skill:changelog:end version=0.8.2 locale=zh-CN -->
+
+
+<!-- release-skill:changelog:start version=0.8.1 locale=zh-CN baseline=sha256:67ed1129fc865709a1205d34c82521a6c7a7f6d9a914c0c400c21ad2767a841b -->
+## [0.8.1] - 2026-08-22
+
+宿主把 Engineering Kit 打包进单文件适配器后，Kit 仍能保留自身的包版本。
+
+### 变更
+
+- Contracts、Harness 与 Engineering Kit 一同升至 0.8.1；Contracts 1.7.0 与 Profile SPI v3 表面保持不变。
+
+### 修复
+
+- 用静态 JSON import 替换运行时基于 import.meta.url 的包清单查找。源码与普通安装包仍读取 Kit 自身清单，esbuild 则把同一版本值内联到宿主 bundle。
+- 新增回归测试：把 Engineering Kit 作为第三方依赖打包成单一宿主入口，在包目录之外运行，并用包清单复核其报告版本。
+
+### 升级说明
+
+把 Engineering Kit 打包进宿主适配器的消费者必须精确锁定 0.8.1；源码和普通安装包消费者沿用现有 API，不需要迁移。
+<!-- release-skill:changelog:end version=0.8.1 locale=zh-CN -->
+
+
 <!-- release-skill:changelog:start version=0.8.0 locale=zh-CN baseline=sha256:0d8fb108ec3e89d5c6b6bea39fc6767a0e1c198546d243d86a963fc5855ed4a9 -->
 ## [0.8.0] - 2026-08-21
 

package/README.md

@@ -4,24 +4,27 @@
 
 # skill-family-engineering-kit
 
-<!-- release-skill:release-version: 0.8.0 -->
+<!-- release-skill:release-version: 0.8.2 -->
 
 An engineering toolkit used in development and CI. There are **exactly four** top-level commands, and no fifth:
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.8.0** (2026-08-21)
+**0.8.2** (2026-08-23)
 
-Profile SPI v3 adds direct verification for scaffolded Project Profiles while descriptor verification remains stable.
+Managed offline Bundles now carry the strict-read source required by the fixed candidate mechanism bridge.
 
 **Added**
 
-- Adds verifyProjectProfile({ projectRoot, profileRelPath? }) for skill-family.project-profile declarations.
-- Keeps verifyProfile descriptor-only and reuses Contracts-owned adoption and overrides field definitions.
-- Adds SPE1008 PROJECT_PROFILE_INVALID; SPE1006 and SPE1007 retain their existing meanings.
+- Projects strict-read.mjs into the managed Bundle and maps its closure, errors, and paths dependencies to sibling runtime modules.
+- Records the real strict-read.mjs source in Foundation provenance and verifies the read-file-strict bridge in an offline runner.
+
+**Changed**
+
+- Moves the package version to 0.8.2 together with Contracts and Harness; the four stable top-level Kit commands remain unchanged.
 
 **Upgrade Notes**
 
-Project-root consumers must pin engineering-kit 0.8.0 and call verifyProjectProfile. Descriptor consumers continue to call verifyProfile; 0.7.0 remains available.
+Consumers must pin Contracts, Harness, and Engineering Kit to exactly 0.8.2 and rebuild the managed Bundle. Existing Bundles do not gain read-file-strict by changing a worktree reference.
 <!-- release-skill:managed:end id=latest-release -->
 
 | Command | Purpose | Side effects |
@@ -42,7 +45,7 @@ Kit is the "engineering stage" layer, depending on the Harness and Contracts. It
 ## Installation and Minimal Example
 
 ```sh
-npm install --save-dev skill-family-engineering-kit@0.8.0
+npm install --save-dev skill-family-engineering-kit@0.8.2
 npm exec -- skill-family-kit --help
 npm exec -- skill-family-kit scaffold --root <empty-dir> --project-id my-project
 npm exec -- skill-family-kit adopt-plan --root <repo>
@@ -50,7 +53,7 @@ npm exec -- skill-family-kit projection --root <repo>
 npm exec -- skill-family-kit check --root <repo>
 ```
 
-The four commands above cover skeleton generation, read-only inventory, managed projection, and diagnostics respectively; a zero-install form is available via `npm exec --package=skill-family-engineering-kit@0.8.0 -- skill-family-kit --help`.
+The four commands above cover skeleton generation, read-only inventory, managed projection, and diagnostics respectively; a zero-install form is available via `npm exec --package=skill-family-engineering-kit@0.8.2 -- skill-family-kit --help`.
 
 ### Public Profile SPI
 

package/README.zh-CN.md

@@ -5,24 +5,27 @@
 
 # skill-family-engineering-kit
 
-<!-- release-skill:release-version: 0.8.0 -->
+<!-- release-skill:release-version: 0.8.2 -->
 
 开发与 CI 阶段使用的工程工具包。**恰好四个**顶层命令，没有第五个：
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.8.0** (2026-08-21)
+**0.8.2** (2026-08-23)
 
-Profile SPI v3 新增 scaffold 项目 Profile 的直接校验，descriptor 校验保持兼容。
+受管离线 Bundle 现在携带固定候选机制桥接所需的 strict-read 源码。
 
 **新增**
 
-- 新增 verifyProjectProfile({ projectRoot, profileRelPath? })，用于校验 skill-family.project-profile 声明。
-- verifyProfile 继续只校验 descriptor，并复用 Contracts 拥有的 adoption 与 overrides 字段定义。
-- 新增 SPE1008 PROJECT_PROFILE_INVALID；SPE1006 与 SPE1007 含义保持不变。
+- 把 strict-read.mjs 投影进受管 Bundle，并把它的 closure、errors 和 paths 依赖映射到相邻运行时模块。
+- 在 Foundation provenance 中记录真实 strict-read.mjs 源码，并通过离线 runner 复验 read-file-strict。
+
+**变更**
+
+- 包版本与 Contracts、Harness 一同升至 0.8.2；Kit 的四个稳定顶层命令保持不变。
 
 **升级说明**
 
-项目根消费者必须锁定 engineering-kit 0.8.0 并调用 verifyProjectProfile；descriptor 消费者继续调用 verifyProfile，0.7.0 仍可使用。
+消费者必须把 Contracts、Harness 和 Engineering Kit 精确锁定到 0.8.2，再重建受管 Bundle。修改工作树引用不会让已有 Bundle 获得 read-file-strict。
 <!-- release-skill:managed:end id=latest-release -->
 
 | 命令 | 用途 | 副作用 |
@@ -43,7 +46,7 @@ Kit 是「工程阶段」层，依赖 Harness 与 Contracts。它只做四件事
 ## 安装和最小示例
 
 ```sh
-npm install --save-dev skill-family-engineering-kit@0.8.0
+npm install --save-dev skill-family-engineering-kit@0.8.2
 npm exec -- skill-family-kit --help
 npm exec -- skill-family-kit scaffold --root <empty-dir> --project-id my-project
 npm exec -- skill-family-kit adopt-plan --root <repo>
@@ -51,7 +54,7 @@ npm exec -- skill-family-kit projection --root <repo>
 npm exec -- skill-family-kit check --root <repo>
 ```
 
-以上四条命令分别覆盖生成骨架、只读盘点、受管投影与诊断；零安装形式可用 `npm exec --package=skill-family-engineering-kit@0.8.0 -- skill-family-kit --help`。
+以上四条命令分别覆盖生成骨架、只读盘点、受管投影与诊断；零安装形式可用 `npm exec --package=skill-family-engineering-kit@0.8.2 -- skill-family-kit --help`。
 
 ### 公共 Profile SPI
 

package/candidate/profile-bundle.mjs

@@ -75,6 +75,13 @@ const HARNESS_IMPORT_MAP = new Map([
   ["../src/closure.mjs", "./closure.mjs"],
   ["../src/errors.mjs", "./errors.mjs"],
   ["../src/paths.mjs", "./paths.mjs"],
+  ["../src/strict-read.mjs", "./strict-read.mjs"],
+]);
+
+const HARNESS_STRICT_READ_IMPORT_MAP = new Map([
+  ["./closure.mjs", "./closure.mjs"],
+  ["./errors.mjs", "./errors.mjs"],
+  ["./paths.mjs", "./paths.mjs"],
 ]);
 
 const HARNESS_CLI_IMPORT_MAP = new Map([
@@ -1175,6 +1182,7 @@ export async function buildQuickstartProfileProjection({
   sources.harnessClosure = await readSourceText(harnessRoot, "src/closure.mjs");
   sources.harnessErrors = await readSourceText(harnessRoot, "src/errors.mjs");
   sources.harnessPaths = await readSourceText(harnessRoot, "src/paths.mjs");
+  sources.harnessStrictRead = await readSourceText(harnessRoot, "src/strict-read.mjs");
   sources.harnessAtomic = await readSourceText(harnessRoot, "src/atomic.mjs");
   sources.harnessTokenLock = await readSourceText(harnessRoot, "src/token-lock.mjs");
   // The package manifests are recorded as complete original bytes below, so
@@ -1367,6 +1375,10 @@ export async function buildQuickstartProfileProjection({
     projectModuleWithImportMap(sources.harnessErrors, new Map([["skill-family-contracts", "../contracts/index.mjs"]]), "harness src/errors.mjs"),
   );
   setText("runtime/harness/paths.mjs", projectModuleWithImportMap(sources.harnessPaths, new Map(), "harness src/paths.mjs"));
+  setText(
+    "runtime/harness/strict-read.mjs",
+    projectModuleWithImportMap(sources.harnessStrictRead, HARNESS_STRICT_READ_IMPORT_MAP, "harness src/strict-read.mjs"),
+  );
   setText(
     "runtime/harness/atomic.mjs",
     projectModuleWithImportMap(sources.harnessAtomic, HARNESS_ATOMIC_IMPORT_MAP, "harness src/atomic.mjs"),
@@ -1468,6 +1480,7 @@ export async function buildQuickstartProfileProjection({
     ["packages/skill-family-harness-node/src/closure.mjs", sources.harnessClosure, "projected"],
     ["packages/skill-family-harness-node/src/errors.mjs", sources.harnessErrors, "projected"],
     ["packages/skill-family-harness-node/src/paths.mjs", sources.harnessPaths, "projected"],
+    ["packages/skill-family-harness-node/src/strict-read.mjs", sources.harnessStrictRead, "projected"],
     ["packages/skill-family-harness-node/src/atomic.mjs", sources.harnessAtomic, "projected"],
     ["packages/skill-family-harness-node/src/token-lock.mjs", sources.harnessTokenLock, "projected"],
     ["packages/skill-family-engineering-kit/package.json", kitPackageJsonText, "identity"],

package/docs/agents/capability-catalog.en.json

@@ -1956,37 +1956,42 @@
   },
   {
    "id": "foundation.harness.quickstart-profile-candidate",
-   "intent": "Construct and verify an observation-bound candidate Task/Result exchange through skill-family-harness-node/candidate/quickstart-profile.",
+   "intent": "Construct and verify a candidate Task/Result exchange and call registered generic mechanisms through the fixed skill-family-harness-node/candidate/quickstart-profile bridge.",
    "useWhen": [
     "Need an early integration trial that binds a contained observation file to a candidate Task and terminal Result",
-    "Need a structured non-throwing verification result for an exact-version candidate exchange"
+    "Need a structured non-throwing verification result for an exact-version candidate exchange",
+    "A host cannot import several Foundation modules directly and needs read-file-strict for a frozen authority file"
    ],
    "doNotUseWhen": [
     "Need a domain auditor, method selector, retry orchestrator, or lifecycle owner",
     "Need a compatibility-frozen Quickstart API"
    ],
    "prerequisites": [
-    "Install exact matching versions of skill-family-harness-node and skill-family-contracts",
-    "The observation path is contained under the supplied root"
+    "Pin skill-family-contracts, skill-family-harness-node, and skill-family-engineering-kit to exactly 0.8.2 and rebuild the managed Bundle",
+    "Observation and read-file-strict paths are contained under the caller-supplied root"
    ],
    "inputs": [
     "Contained root and observation path",
     "Operation identity, method, parameters, and run/stage/attempt correlation",
-    "Candidate Task and Result documents for verification"
+    "Candidate Task and Result documents for verification",
+    "A read-file-strict request with closed root, path, encoding?, and expectedSha256? parameters"
    ],
    "outputs": [
-    "Observation Resource, candidate Task, terminal Result, or structured exchange verification"
+    "Observation Resource, candidate Task, terminal Result, or structured exchange verification",
+    "A read-file-strict receipt with UTF-8 content as a string or binary content in the standard Buffer JSON shape"
    ],
    "sideEffects": [
-    "Reads the contained observation file to compute or verify its sha256 digest",
+    "Reads a contained observation or authority file to compute or verify its sha256 digest",
     "Does not write files or access Git or the network"
    ],
    "failureSemantics": [
     "Throwing APIs fail closed with SFC2004 and details.kind=invalid-result when the profile or binding is invalid",
-    "verifyQuickstartExchange converts a failure into {valid:false, code, message, details}"
+    "verifyQuickstartExchange converts a failure into {valid:false, code, message, details}",
+    "Direct read-file-strict calls retain core SFC2004 details.kind failures; the JSON CLI promises only exit codes 0/2 and name/message errors"
    ],
    "invariants": [
     "The Result must bind the exact Task digest, real Resource bytes, globally unique Resource ids, operation identity, correlation fields, and the complete evidence-binding set",
+    "read-file-strict only forwards to the existing readFileStrict implementation; it copies no path, read, or digest algorithm and accepts no arbitrary function name",
     "Stability is candidate: a later minor release may change or remove this subpath"
    ],
    "ownedByCaller": [
@@ -2010,7 +2015,7 @@
     "Need to bypass target manifest authorization or handwritten-file protection"
    ],
    "prerequisites": [
-    "Install exact matching 0.3.0 versions of all three Foundation packages",
+    "Install exact matching 0.8.2 versions of all three Foundation packages",
     "The target prefix is a contained relative POSIX path"
    ],
    "inputs": [
@@ -2019,7 +2024,8 @@
     "Exact installed Contracts, Harness, and Kit package bytes"
    ],
    "outputs": [
-    "A projection manifest and provenance record with Foundation sources, consumer schemas, payload digests, tool versions, and licenses"
+    "A projection manifest and provenance record with Foundation sources, consumer schemas, payload digests, tool versions, and licenses",
+    "An offline runner carrying strict-read source and provenance, with the fixed read-file-strict operation"
    ],
    "sideEffects": [
     "Builds the manifest in memory and reads installed package plus explicit consumer-schema files",
@@ -2031,6 +2037,7 @@
    ],
    "invariants": [
     "The Bundle contains no node_modules or runtime Ajv and runs without installed Foundation packages or network access",
+    "The managed Bundle is rebuilt from installed 0.8.2 package bytes and never imports source from a Foundation worktree",
     "The helper adds no top-level Kit command and never bypasses runProjection",
     "Stability is candidate: a later minor release may change or remove this subpath"
    ],

package/docs/agents/capability-catalog.json

@@ -1202,10 +1202,11 @@
    "since": "0.2.1",
    "stability": "candidate",
    "entrypoints": [
-    "skill-family-harness-node/candidate/quickstart-profile: createObservationResource, verifyResourceBytes, verifyObservationResource, createQuickstartTask, wrapQuickstartResult, assertQuickstartExchange, verifyQuickstartExchange, canonicalJson, computeResourceClosure, digestBytes, digestDocument (packages/skill-family-harness-node/candidate/quickstart-profile.mjs)"
+    "skill-family-harness-node/candidate/quickstart-profile: createObservationResource, verifyResourceBytes, verifyObservationResource, createQuickstartTask, wrapQuickstartResult, assertQuickstartExchange, verifyQuickstartExchange, invokeFoundationMechanism[read-file-strict], canonicalJson, computeResourceClosure, digestBytes, digestDocument (packages/skill-family-harness-node/candidate/quickstart-profile.mjs)"
    ],
    "sourceRefs": [
-    "packages/skill-family-harness-node/candidate/quickstart-profile.mjs"
+    "packages/skill-family-harness-node/candidate/quickstart-profile.mjs",
+    "packages/skill-family-harness-node/src/strict-read.mjs"
    ],
    "positiveTestRefs": [
     "packages/skill-family-harness-node/test/quickstart-profile.test.mjs"

package/docs/agents/capability-catalog.zh-CN.json

@@ -1956,37 +1956,42 @@
   },
   {
    "id": "foundation.harness.quickstart-profile-candidate",
-   "intent": "通过 skill-family-harness-node/candidate/quickstart-profile 构造并复验绑定 observation 的候选 Task/Result 交换",
+   "intent": "通过 skill-family-harness-node/candidate/quickstart-profile 构造并复验候选 Task/Result 交换，并通过固定机制桥接调用已登记的通用机制",
    "useWhen": [
     "需要开展早期接入试验，把受收容的 observation 文件绑定到候选 Task 与终态 Result",
-    "需要为锁定精确版本的候选交换取得结构化、不抛出的复验结果"
+    "需要为锁定精确版本的候选交换取得结构化、不抛出的复验结果",
+    "宿主不能直接导入多个 Foundation 模块，需要通过 read-file-strict 读取冻结权威文件"
    ],
    "doNotUseWhen": [
     "需要领域审计器、method 选择器、重试编排或生命周期所有者",
     "需要兼容性已冻结的 Quickstart API"
    ],
    "prerequisites": [
-    "安装精确匹配的 skill-family-harness-node 与 skill-family-contracts 版本",
-    "observation 路径受 supplied root 收容"
+    "把 skill-family-contracts、skill-family-harness-node 与 skill-family-engineering-kit 精确锁定到 0.8.2，并重建受管 Bundle",
+    "observation 路径与 read-file-strict 路径受调用方提供的 root 收容"
    ],
    "inputs": [
     "受收容根与 observation 路径",
     "operation 身份、method、parameters 与 run/stage/attempt correlation",
-    "待复验的候选 Task 与 Result 文档"
+    "待复验的候选 Task 与 Result 文档",
+    "read-file-strict 请求：闭合的 root、path、encoding? 与 expectedSha256? 参数"
    ],
    "outputs": [
-    "Observation Resource、候选 Task、终态 Result 或结构化交换复验结果"
+    "Observation Resource、候选 Task、终态 Result 或结构化交换复验结果",
+    "read-file-strict 回执；UTF-8 内容为字符串，二进制内容为标准 Buffer JSON 形态"
    ],
    "sideEffects": [
-    "读取受收容的 observation 文件，以计算或复验 sha256 摘要",
+    "读取受收容的 observation 或权威文件，以计算或复验 sha256 摘要",
     "不写文件，不访问 Git 或网络"
    ],
    "failureSemantics": [
     "Profile 或绑定无效时，抛出式 API 以 SFC2004 与 details.kind=invalid-result 失败关闭",
-    "verifyQuickstartExchange 把失败转成 {valid:false, code, message, details}"
+    "verifyQuickstartExchange 把失败转成 {valid:false, code, message, details}",
+    "read-file-strict 直接调用沿用核心 SFC2004 与 details.kind；JSON CLI 只承诺退出码 0/2 和 name/message 错误形态"
    ],
    "invariants": [
     "Result 必须绑定精确 Task 摘要、真实 Resource 字节、全局唯一 Resource id、operation 身份、correlation 字段与完整 evidence binding 集合",
+    "read-file-strict 只转发既有 readFileStrict，不复制路径、读取或摘要算法，也不接受任意函数名",
     "稳定性为 candidate：后续小版本可以修改或移除该子路径"
    ],
    "ownedByCaller": [
@@ -2010,7 +2015,7 @@
     "需要绕过目标 manifest 授权或手写文件保护"
    ],
    "prerequisites": [
-    "安装精确匹配的三个 Foundation 0.3.0 包版本",
+    "安装精确匹配的三个 Foundation 0.8.2 包版本",
     "targetPrefix 是受收容的 POSIX 相对路径"
    ],
    "inputs": [
@@ -2019,7 +2024,8 @@
     "已安装 Contracts、Harness 与 Kit 的精确包字节"
    ],
    "outputs": [
-    "投影 manifest 与 provenance 记录，包含 Foundation 来源、消费者 Schema、payload 摘要、工具版本与许可证"
+    "投影 manifest 与 provenance 记录，包含 Foundation 来源、消费者 Schema、payload 摘要、工具版本与许可证",
+    "携带 strict-read 源码和 provenance 的离线 runner，可调用固定 read-file-strict"
    ],
    "sideEffects": [
     "在内存中构建 manifest，并读取已安装包文件与显式消费者 Schema 文件",
@@ -2031,6 +2037,7 @@
    ],
    "invariants": [
     "Bundle 不含 node_modules 或运行时 Ajv，不依赖已安装 Foundation 包或网络",
+    "受管 Bundle 从 0.8.2 的已安装包字节重建，不从 Foundation 工作树导入源码",
     "辅助函数不增加 Kit 顶层命令，也不绕过 runProjection",
     "稳定性为 candidate：后续小版本可以修改或移除该子路径"
    ],

package/docs/public/status/index.html

@@ -1792,17 +1792,17 @@
 <tbody>
 <tr>
 <td><code>skill-family-contracts</code></td>
-<td>0.8.0</td>
+<td>0.8.2</td>
 <td><a href="https://github.com/ifoohoo/skill-family-contracts">ifoohoo/skill-family-contracts</a></td>
 </tr>
 <tr>
 <td><code>skill-family-harness-node</code></td>
-<td>0.8.0</td>
+<td>0.8.2</td>
 <td><a href="https://github.com/ifoohoo/skill-family-harness-node">ifoohoo/skill-family-harness-node</a></td>
 </tr>
 <tr>
 <td><code>skill-family-engineering-kit</code></td>
-<td>0.8.0</td>
+<td>0.8.2</td>
 <td><a href="https://github.com/ifoohoo/skill-family-engineering-kit">ifoohoo/skill-family-engineering-kit</a></td>
 </tr>
 </tbody>

package/docs/reference/api/harness/index.html

@@ -748,6 +748,34 @@
       </ul>
     </nav>
 
+</li>
+
+        <li class="md-nav__item">
+  <a href="#严格读取-foundationharnessstrict-read" class="md-nav__link">
+    <span class="md-ellipsis">
+
+        严格读取 (foundation.harness.strict-read)
+
+    </span>
+  </a>
+
+    <nav class="md-nav" aria-label="严格读取 (foundation.harness.strict-read)">
+      <ul class="md-nav__list">
+
+          <li class="md-nav__item">
+  <a href="#readFileStrict" class="md-nav__link">
+    <span class="md-ellipsis">
+
+        readFileStrict
+
+    </span>
+  </a>
+
+</li>
+
+      </ul>
+    </nav>
+
 </li>
 
         <li class="md-nav__item">
@@ -1145,6 +1173,23 @@
     </span>
   </a>
 
+    <nav class="md-nav" aria-label="Quickstart Profile v2 candidate">
+      <ul class="md-nav__list">
+
+          <li class="md-nav__item">
+  <a href="#invokeFoundationMechanism" class="md-nav__link">
+    <span class="md-ellipsis">
+
+        invokeFoundationMechanism
+
+    </span>
+  </a>
+
+</li>
+
+      </ul>
+    </nav>
+
 </li>
 
         <li class="md-nav__item">
@@ -2191,6 +2236,34 @@
       </ul>
     </nav>
 
+</li>
+
+        <li class="md-nav__item">
+  <a href="#严格读取-foundationharnessstrict-read" class="md-nav__link">
+    <span class="md-ellipsis">
+
+        严格读取 (foundation.harness.strict-read)
+
+    </span>
+  </a>
+
+    <nav class="md-nav" aria-label="严格读取 (foundation.harness.strict-read)">
+      <ul class="md-nav__list">
+
+          <li class="md-nav__item">
+  <a href="#readFileStrict" class="md-nav__link">
+    <span class="md-ellipsis">
+
+        readFileStrict
+
+    </span>
+  </a>
+
+</li>
+
+      </ul>
+    </nav>
+
 </li>
 
         <li class="md-nav__item">
@@ -2588,6 +2661,23 @@
     </span>
   </a>
 
+    <nav class="md-nav" aria-label="Quickstart Profile v2 candidate">
+      <ul class="md-nav__list">
+
+          <li class="md-nav__item">
+  <a href="#invokeFoundationMechanism" class="md-nav__link">
+    <span class="md-ellipsis">
+
+        invokeFoundationMechanism
+
+    </span>
+  </a>
+
+</li>
+
+      </ul>
+    </nav>
+
 </li>
 
         <li class="md-nav__item">
@@ -2620,11 +2710,12 @@
 
 <h1 id="skill-family-harness-node-公共-API-参考">skill-family-harness-node 公共 API 参考<a class="headerlink" href="#skill-family-harness-node-公共-API-参考" title="Permanent link">&para;</a></h1>
 <p>本页从真实导出（<code>src/index.mjs</code> 与各源模块）核对，不手写无法证明新鲜度的全集。每个公共入口按 hand-off §4.3 说明：签名、输入与输出、是否纯函数、文件/进程/Git/网络副作用、稳定错误码与 <code>details.kind</code>、前置条件与信任锚、<code>since</code> 与 <code>stability</code>、源文件与正例/负例测试、调用方仍拥有的业务语义。</p>
-<p>Harness 是薄运行时：消费 Contracts，只实现业务中立机制；不拥有业务语义、编排、Git、网络与第二语言。包级常量：<code>HARNESS_CAPABILITIES</code>（19 项能力，闭集）、<code>HARNESS_EXCLUSIONS</code>（明确排除 <code>business-semantics</code> / <code>workflow-orchestration</code> / <code>git-writes</code> / <code>model-calls</code> / <code>release-state</code> / <code>remote-network-access</code>）。</p>
+<p>Harness 是薄运行时：消费 Contracts，只实现业务中立机制；不拥有业务语义、编排、Git、网络与第二语言。包级常量：<code>HARNESS_CAPABILITIES</code>（21 项能力，闭集）、<code>HARNESS_EXCLUSIONS</code>（明确排除 <code>business-semantics</code> / <code>workflow-orchestration</code> / <code>git-writes</code> / <code>model-calls</code> / <code>release-state</code> / <code>remote-network-access</code>）。</p>
 <p>能力分组（与 <code>docs/agents/capability-catalog.json</code> 对应）：</p>
 <ul>
 <li><a href="#契约校验-foundationharnesscontract-validation">契约校验</a> → <code>validateContractDocument</code> / <code>getValidator</code></li>
 <li><a href="#路径收容-foundationharnesspath-containment">路径收容</a> → <code>classifyPathInput</code> / <code>resolveContained</code> / <code>readFileContained</code></li>
+<li><a href="#严格读取-foundationharnessstrict-read">严格读取</a> → <code>readFileStrict</code></li>
 <li><a href="#原子写-foundationharnessatomic-write">原子写</a> → <code>writeFileAtomic</code></li>
 <li><a href="#临时工作区-foundationharnesstemporary-workspace">临时工作区</a> → <code>TemporaryWorkspace</code> / <code>withTemporaryWorkspace</code></li>
 <li><a href="#资源闭包-foundationharnessresource-closure">资源闭包</a> → <code>computeResourceClosure</code> / <code>digestBytes</code> / <code>closureContains</code></li>
@@ -2679,6 +2770,23 @@
 <li>调用方仍拥有的业务语义：哪些路径是业务允许的选择规则（业务选择语义留在调用方）。</li>
 </ul>
 <hr />
+<h2 id="严格读取-foundationharnessstrict-read">严格读取 (foundation.harness.strict-read)<a class="headerlink" href="#严格读取-foundationharnessstrict-read" title="Permanent link">&para;</a></h2>
+<h3 id="readFileStrict">readFileStrict<a class="headerlink" href="#readFileStrict" title="Permanent link">&para;</a></h3>
+<ul>
+<li>签名：<code>readFileStrict(root, relPath, { encoding?, expectedSha256? } = {})</code>（async）。</li>
+<li>输入：收容根目录、相对文件路径，可选的 <code>utf8</code> 编码与小写 sha256 预期摘要。</li>
+<li>输出：冻结回执 <code>{ path, content, sha256, bytes, mode }</code>。指定 <code>utf8</code> 时，<code>content</code> 是字符串；省略编码时，<code>content</code> 是 <code>Buffer</code>。</li>
+<li>纯函数：否，函数只读一个受收容的普通文件。</li>
+<li>副作用：执行 <code>lstat</code>、<code>open</code>、<code>read</code> 与文件身份复核；不写文件，不访问 Git 或网络。</li>
+<li>稳定错误码与 <code>details.kind</code>：失败使用 <code>SFC2004</code>。缺失文件返回 <code>missing-resource</code>，摘要不符返回 <code>content-guard-rejected</code>，目录返回 <code>read-failed</code>，越界路径沿用路径收容的失败种类。</li>
+<li>符号链接边界：叶节点符号链接始终拒绝。祖先目录可以是指向根内目录的符号链接；其规范路径仍须受 <code>root</code> 收容。</li>
+<li>前置条件与信任锚：<code>expectedSha256</code> 的来源与信任由调用方负责；摘要只覆盖实际读到的字节。</li>
+<li><code>since</code> / <code>stability</code>：<code>0.6.0</code> / <code>stable</code>。</li>
+<li>源文件：<code>packages/skill-family-harness-node/src/strict-read.mjs</code>。</li>
+<li>正例/负例测试：<code>packages/skill-family-harness-node/test/strict-read.test.mjs</code>。</li>
+<li>调用方仍拥有的业务语义：选择哪个权威文件、摘要从何而来，以及读取失败后的处置。</li>
+</ul>
+<hr />
 <h2 id="原子写-foundationharnessatomic-write">原子写 (foundation.harness.atomic-write)<a class="headerlink" href="#原子写-foundationharnessatomic-write" title="Permanent link">&para;</a></h2>
 <h3 id="writeFileAtomic">writeFileAtomic<a class="headerlink" href="#writeFileAtomic" title="Permanent link">&para;</a></h3>
 <ul>
@@ -3043,7 +3151,22 @@
 <hr />
 <h2 id="Quickstart-Profile-v2-candidate">Quickstart Profile v2 candidate<a class="headerlink" href="#Quickstart-Profile-v2-candidate" title="Permanent link">&para;</a></h2>
 <p><code>skill-family-harness-node/candidate/quickstart-profile</code> 负责创建 observation Resource、Task 与终态 Result，并复验真实文件字节、Resource id 全局唯一性、Task digest、operation 身份、逐字段 <code>run/stage/attempt</code> 以及 evidence 精确回指。<code>verifyQuickstartExchange</code> 把机制拒绝转换成结构化结果，抛出式入口继续使用已登记的 <code>SFC2004</code> 与稳定 <code>details.kind</code>。</p>
-<p>该入口不选择 method，不解释 domainResult，也不拥有重试、调度或生命周期。0.3.0 的 v2 与 0.2.1 的 v1 不兼容；接入必须精确锁定所选版本。</p>
+<h3 id="invokeFoundationMechanism">invokeFoundationMechanism<a class="headerlink" href="#invokeFoundationMechanism" title="Permanent link">&para;</a></h3>
+<p><code>invokeFoundationMechanism(request)</code> 是固定机制桥接。调用方只能选择预先登记的 operation，不能传入模块名、导出名或任意函数。0.8.2 新增的 <code>read-file-strict</code> 直接调用上文的 <code>readFileStrict</code>：</p>
+<pre><code class="language-json">{
+  &quot;operation&quot;: &quot;read-file-strict&quot;,
+  &quot;params&quot;: {
+    &quot;root&quot;: &quot;/absolute/consumer-root&quot;,
+    &quot;path&quot;: &quot;authority/frozen.json&quot;,
+    &quot;encoding&quot;: &quot;utf8&quot;,
+    &quot;expectedSha256&quot;: &quot;&lt;lowercase-sha256&gt;&quot;
+  }
+}
+</code></pre>
+<p><code>params</code> 是闭合对象。<code>root</code> 与 <code>path</code> 是必填非空字符串；<code>encoding</code> 只能是 <code>utf8</code> 或省略；<code>expectedSha256</code> 省略时不做预期摘要比对，提供时沿用核心严格读取合同。</p>
+<p>桥接保留核心回执的 <code>path</code>、<code>sha256</code>、<code>bytes</code> 与 <code>mode</code>。UTF-8 内容仍是字符串；二进制内容投影成 Node 标准的 Buffer JSON 形态 <code>{ "type": "Buffer", "data": [...] }</code>，以便通过 JSON 传输后无损还原字节。</p>
+<p>直接调用失败时沿用核心异常，包括 <code>SFC2004</code> 与 <code>details.kind</code>。候选 <code>mechanisms-cli.mjs</code> 继续使用一请求一响应 JSON：成功退出 0，拒绝或用法错误退出 2；CLI 错误 JSON 只承诺 <code>name</code> 与 <code>message</code>，不承诺跨语言保留 <code>details</code>。</p>
+<p>该入口不选择 method，不解释 domainResult，也不拥有重试、调度或生命周期。消费者必须把 Contracts、Harness 与 Engineering Kit 精确锁定到 0.8.2，并重建受管 Bundle；禁止从 Foundation 工作树导入候选源码。0.3.0 的 v2 与 0.2.1 的 v1 不兼容。</p>
 <hr />
 <h2 id="与机器事实层的互链">与机器事实层的互链<a class="headerlink" href="#与机器事实层的互链" title="Permanent link">&para;</a></h2>
 <ul>