skill-family-engineering-kit 0.8.2 → 0.8.3

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.8.3 locale=en baseline=sha256:93875982c9f941309d63e40d5758b0fe7b20d74242f71934c3fd3cd90fe6ba52 -->
+## [0.8.3] - 2026-08-23
+
+Lockstep patch release whose managed Bundle carries the bounded Harness containment fix.
+
+### Changed
+
+- Moves the package version to 0.8.3 together with Contracts and Harness; the four stable top-level Kit commands and Profile SPI remain unchanged.
+- Rebuilding a managed Bundle projects the updated Harness paths module, including its single ENOENT anchor recomputation and unchanged fail-closed boundaries.
+
+### Upgrade Notes
+
+Consumers must pin Contracts, Harness, and Engineering Kit to exactly 0.8.3 and rebuild the managed Bundle. No Kit API or Profile SPI migration is required.
+<!-- release-skill:changelog:end version=0.8.3 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.8.2 locale=en baseline=sha256:cebfcfd816f8fd5824135d2681f443e5b226d65096bb6f6a9360f6b3bba34fc1 -->
 ## [0.8.2] - 2026-08-23
 

package/CHANGELOG.zh-CN.md

@@ -1,5 +1,21 @@
 # 变更日志
 
+<!-- release-skill:changelog:start version=0.8.3 locale=zh-CN baseline=sha256:3315d4594a7e28926b54dae3057c35d192b1e9293d07d22fd8856f44da2a7d80 -->
+## [0.8.3] - 2026-08-23
+
+随 Foundation 0.8.3 锁步升版；受管 Bundle 携带 Harness 的有界路径收容修复。
+
+### 变更
+
+- 包版本与 Contracts、Harness 一同升至 0.8.3；Kit 的四个稳定顶层命令与 Profile SPI 均保持不变。
+- 重建受管 Bundle 会投影更新后的 Harness paths 模块，包括仅一次 ENOENT 锚点重求和保持不变的失败关闭边界。
+
+### 升级说明
+
+消费者必须把 Contracts、Harness 和 Engineering Kit 精确锁定到 0.8.3，再重建受管 Bundle；无需迁移 Kit API 或 Profile SPI。
+<!-- release-skill:changelog:end version=0.8.3 locale=zh-CN -->
+
+
 <!-- release-skill:changelog:start version=0.8.2 locale=zh-CN baseline=sha256:620f03e3fc81c1ef06d23b99fb0e70e547d58f3c6e956691b9c4a05e1b517c3b -->
 ## [0.8.2] - 2026-08-23
 

package/README.md

@@ -4,27 +4,23 @@
 
 # skill-family-engineering-kit
 
-<!-- release-skill:release-version: 0.8.2 -->
+<!-- release-skill:release-version: 0.8.3 -->
 
 An engineering toolkit used in development and CI. There are **exactly four** top-level commands, and no fifth:
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.8.2** (2026-08-23)
+**0.8.3** (2026-08-23)
 
-Managed offline Bundles now carry the strict-read source required by the fixed candidate mechanism bridge.
-
-**Added**
-
-- Projects strict-read.mjs into the managed Bundle and maps its closure, errors, and paths dependencies to sibling runtime modules.
-- Records the real strict-read.mjs source in Foundation provenance and verifies the read-file-strict bridge in an offline runner.
+Lockstep patch release whose managed Bundle carries the bounded Harness containment fix.
 
 **Changed**
 
-- Moves the package version to 0.8.2 together with Contracts and Harness; the four stable top-level Kit commands remain unchanged.
+- Moves the package version to 0.8.3 together with Contracts and Harness; the four stable top-level Kit commands and Profile SPI remain unchanged.
+- Rebuilding a managed Bundle projects the updated Harness paths module, including its single ENOENT anchor recomputation and unchanged fail-closed boundaries.
 
 **Upgrade Notes**
 
-Consumers must pin Contracts, Harness, and Engineering Kit to exactly 0.8.2 and rebuild the managed Bundle. Existing Bundles do not gain read-file-strict by changing a worktree reference.
+Consumers must pin Contracts, Harness, and Engineering Kit to exactly 0.8.3 and rebuild the managed Bundle. No Kit API or Profile SPI migration is required.
 <!-- release-skill:managed:end id=latest-release -->
 
 | Command | Purpose | Side effects |
@@ -45,7 +41,7 @@ Kit is the "engineering stage" layer, depending on the Harness and Contracts. It
 ## Installation and Minimal Example
 
 ```sh
-npm install --save-dev skill-family-engineering-kit@0.8.2
+npm install --save-dev skill-family-engineering-kit@0.8.3
 npm exec -- skill-family-kit --help
 npm exec -- skill-family-kit scaffold --root <empty-dir> --project-id my-project
 npm exec -- skill-family-kit adopt-plan --root <repo>
@@ -53,7 +49,7 @@ npm exec -- skill-family-kit projection --root <repo>
 npm exec -- skill-family-kit check --root <repo>
 ```
 
-The four commands above cover skeleton generation, read-only inventory, managed projection, and diagnostics respectively; a zero-install form is available via `npm exec --package=skill-family-engineering-kit@0.8.2 -- skill-family-kit --help`.
+The four commands above cover skeleton generation, read-only inventory, managed projection, and diagnostics respectively; a zero-install form is available via `npm exec --package=skill-family-engineering-kit@0.8.3 -- skill-family-kit --help`.
 
 ### Public Profile SPI
 

package/README.zh-CN.md

@@ -5,27 +5,23 @@
 
 # skill-family-engineering-kit
 
-<!-- release-skill:release-version: 0.8.2 -->
+<!-- release-skill:release-version: 0.8.3 -->
 
 开发与 CI 阶段使用的工程工具包。**恰好四个**顶层命令，没有第五个：
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.8.2** (2026-08-23)
+**0.8.3** (2026-08-23)
 
-受管离线 Bundle 现在携带固定候选机制桥接所需的 strict-read 源码。
-
-**新增**
-
-- 把 strict-read.mjs 投影进受管 Bundle，并把它的 closure、errors 和 paths 依赖映射到相邻运行时模块。
-- 在 Foundation provenance 中记录真实 strict-read.mjs 源码，并通过离线 runner 复验 read-file-strict。
+随 Foundation 0.8.3 锁步升版；受管 Bundle 携带 Harness 的有界路径收容修复。
 
 **变更**
 
-- 包版本与 Contracts、Harness 一同升至 0.8.2；Kit 的四个稳定顶层命令保持不变。
+- 包版本与 Contracts、Harness 一同升至 0.8.3；Kit 的四个稳定顶层命令与 Profile SPI 均保持不变。
+- 重建受管 Bundle 会投影更新后的 Harness paths 模块，包括仅一次 ENOENT 锚点重求和保持不变的失败关闭边界。
 
 **升级说明**
 
-消费者必须把 Contracts、Harness 和 Engineering Kit 精确锁定到 0.8.2，再重建受管 Bundle。修改工作树引用不会让已有 Bundle 获得 read-file-strict。
+消费者必须把 Contracts、Harness 和 Engineering Kit 精确锁定到 0.8.3，再重建受管 Bundle；无需迁移 Kit API 或 Profile SPI。
 <!-- release-skill:managed:end id=latest-release -->
 
 | 命令 | 用途 | 副作用 |
@@ -46,7 +42,7 @@ Kit 是「工程阶段」层，依赖 Harness 与 Contracts。它只做四件事
 ## 安装和最小示例
 
 ```sh
-npm install --save-dev skill-family-engineering-kit@0.8.2
+npm install --save-dev skill-family-engineering-kit@0.8.3
 npm exec -- skill-family-kit --help
 npm exec -- skill-family-kit scaffold --root <empty-dir> --project-id my-project
 npm exec -- skill-family-kit adopt-plan --root <repo>
@@ -54,7 +50,7 @@ npm exec -- skill-family-kit projection --root <repo>
 npm exec -- skill-family-kit check --root <repo>
 ```
 
-以上四条命令分别覆盖生成骨架、只读盘点、受管投影与诊断；零安装形式可用 `npm exec --package=skill-family-engineering-kit@0.8.2 -- skill-family-kit --help`。
+以上四条命令分别覆盖生成骨架、只读盘点、受管投影与诊断；零安装形式可用 `npm exec --package=skill-family-engineering-kit@0.8.3 -- skill-family-kit --help`。
 
 ### 公共 Profile SPI
 

package/docs/agents/capability-catalog.en.json

@@ -1967,7 +1967,7 @@
     "Need a compatibility-frozen Quickstart API"
    ],
    "prerequisites": [
-    "Pin skill-family-contracts, skill-family-harness-node, and skill-family-engineering-kit to exactly 0.8.2 and rebuild the managed Bundle",
+    "Pin skill-family-contracts, skill-family-harness-node, and skill-family-engineering-kit to exactly 0.8.3 and rebuild the managed Bundle",
     "Observation and read-file-strict paths are contained under the caller-supplied root"
    ],
    "inputs": [
@@ -2015,7 +2015,7 @@
     "Need to bypass target manifest authorization or handwritten-file protection"
    ],
    "prerequisites": [
-    "Install exact matching 0.8.2 versions of all three Foundation packages",
+    "Install exact matching 0.8.3 versions of all three Foundation packages",
     "The target prefix is a contained relative POSIX path"
    ],
    "inputs": [
@@ -2037,7 +2037,7 @@
    ],
    "invariants": [
     "The Bundle contains no node_modules or runtime Ajv and runs without installed Foundation packages or network access",
-    "The managed Bundle is rebuilt from installed 0.8.2 package bytes and never imports source from a Foundation worktree",
+    "The managed Bundle is rebuilt from installed 0.8.3 package bytes and never imports source from a Foundation worktree",
     "The helper adds no top-level Kit command and never bypasses runProjection",
     "Stability is candidate: a later minor release may change or remove this subpath"
    ],

package/docs/agents/capability-catalog.zh-CN.json

@@ -1967,7 +1967,7 @@
     "需要兼容性已冻结的 Quickstart API"
    ],
    "prerequisites": [
-    "把 skill-family-contracts、skill-family-harness-node 与 skill-family-engineering-kit 精确锁定到 0.8.2，并重建受管 Bundle",
+    "把 skill-family-contracts、skill-family-harness-node 与 skill-family-engineering-kit 精确锁定到 0.8.3，并重建受管 Bundle",
     "observation 路径与 read-file-strict 路径受调用方提供的 root 收容"
    ],
    "inputs": [
@@ -2015,7 +2015,7 @@
     "需要绕过目标 manifest 授权或手写文件保护"
    ],
    "prerequisites": [
-    "安装精确匹配的三个 Foundation 0.8.2 包版本",
+    "安装精确匹配的三个 Foundation 0.8.3 包版本",
     "targetPrefix 是受收容的 POSIX 相对路径"
    ],
    "inputs": [
@@ -2037,7 +2037,7 @@
    ],
    "invariants": [
     "Bundle 不含 node_modules 或运行时 Ajv，不依赖已安装 Foundation 包或网络",
-    "受管 Bundle 从 0.8.2 的已安装包字节重建，不从 Foundation 工作树导入源码",
+    "受管 Bundle 从 0.8.3 的已安装包字节重建，不从 Foundation 工作树导入源码",
     "辅助函数不增加 Kit 顶层命令，也不绕过 runProjection",
     "稳定性为 candidate：后续小版本可以修改或移除该子路径"
    ],

package/docs/public/status/index.html

@@ -1792,17 +1792,17 @@
 <tbody>
 <tr>
 <td><code>skill-family-contracts</code></td>
-<td>0.8.2</td>
+<td>0.8.3</td>
 <td><a href="https://github.com/ifoohoo/skill-family-contracts">ifoohoo/skill-family-contracts</a></td>
 </tr>
 <tr>
 <td><code>skill-family-harness-node</code></td>
-<td>0.8.2</td>
+<td>0.8.3</td>
 <td><a href="https://github.com/ifoohoo/skill-family-harness-node">ifoohoo/skill-family-harness-node</a></td>
 </tr>
 <tr>
 <td><code>skill-family-engineering-kit</code></td>
-<td>0.8.2</td>
+<td>0.8.3</td>
 <td><a href="https://github.com/ifoohoo/skill-family-engineering-kit">ifoohoo/skill-family-engineering-kit</a></td>
 </tr>
 </tbody>

package/docs/reference/api/harness/index.html

@@ -3166,7 +3166,7 @@
 <p><code>params</code> 是闭合对象。<code>root</code> 与 <code>path</code> 是必填非空字符串；<code>encoding</code> 只能是 <code>utf8</code> 或省略；<code>expectedSha256</code> 省略时不做预期摘要比对，提供时沿用核心严格读取合同。</p>
 <p>桥接保留核心回执的 <code>path</code>、<code>sha256</code>、<code>bytes</code> 与 <code>mode</code>。UTF-8 内容仍是字符串；二进制内容投影成 Node 标准的 Buffer JSON 形态 <code>{ "type": "Buffer", "data": [...] }</code>，以便通过 JSON 传输后无损还原字节。</p>
 <p>直接调用失败时沿用核心异常，包括 <code>SFC2004</code> 与 <code>details.kind</code>。候选 <code>mechanisms-cli.mjs</code> 继续使用一请求一响应 JSON：成功退出 0，拒绝或用法错误退出 2；CLI 错误 JSON 只承诺 <code>name</code> 与 <code>message</code>，不承诺跨语言保留 <code>details</code>。</p>
-<p>该入口不选择 method，不解释 domainResult，也不拥有重试、调度或生命周期。消费者必须把 Contracts、Harness 与 Engineering Kit 精确锁定到 0.8.2，并重建受管 Bundle；禁止从 Foundation 工作树导入候选源码。0.3.0 的 v2 与 0.2.1 的 v1 不兼容。</p>
+<p>该入口不选择 method，不解释 domainResult，也不拥有重试、调度或生命周期。消费者必须把 Contracts、Harness 与 Engineering Kit 精确锁定到 0.8.3，并重建受管 Bundle；禁止从 Foundation 工作树导入候选源码。0.3.0 的 v2 与 0.2.1 的 v1 不兼容。</p>
 <hr />
 <h2 id="与机器事实层的互链">与机器事实层的互链<a class="headerlink" href="#与机器事实层的互链" title="Permanent link">&para;</a></h2>
 <ul>