skill-family-engineering-kit 0.8.2 → 0.8.4

package/CHANGELOG.md

@@ -1,5 +1,38 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.8.4 locale=en baseline=sha256:0f6ad4e641ae6ef85ea323e458aa6263aa6d87280e704ac1324742f83016d779 -->
+## [0.8.4] - 2026-08-24
+
+Lockstep Foundation 0.8.4 update documents validated external source authority without changing Kit commands or Profile SPI.
+
+### Changed
+
+- Moves the package version to 0.8.4 together with Contracts and Harness.
+- Documents that consumers validate a source-authority receipt through Contracts before passing the returned coordinates through the existing sourceRepository and sourceBaseCommit fields.
+- Keeps the four stable top-level Kit commands, builder, Profile SPI, and public exports unchanged.
+
+### Upgrade Notes
+
+Pin all three Foundation packages to exactly 0.8.4. A provider Profile descriptor upgrading from 0.8.3 and Contracts 1.7.0 must mechanically update its base.contractsVersion field to 1.8.0. Existing functions and Schema shapes, Profile SPI v3, and the four Kit commands require no migration; source-authority consumers only add the Contracts validation step before invoking the existing builder surface.
+<!-- release-skill:changelog:end version=0.8.4 locale=en -->
+
+
+<!-- release-skill:changelog:start version=0.8.3 locale=en baseline=sha256:93875982c9f941309d63e40d5758b0fe7b20d74242f71934c3fd3cd90fe6ba52 -->
+## [0.8.3] - 2026-08-23
+
+Lockstep patch release whose managed Bundle carries the bounded Harness containment fix.
+
+### Changed
+
+- Moves the package version to 0.8.3 together with Contracts and Harness; the four stable top-level Kit commands and Profile SPI remain unchanged.
+- Rebuilding a managed Bundle projects the updated Harness paths module, including its single ENOENT anchor recomputation and unchanged fail-closed boundaries.
+
+### Upgrade Notes
+
+Consumers must pin Contracts, Harness, and Engineering Kit to exactly 0.8.3 and rebuild the managed Bundle. No Kit API or Profile SPI migration is required.
+<!-- release-skill:changelog:end version=0.8.3 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.8.2 locale=en baseline=sha256:cebfcfd816f8fd5824135d2681f443e5b226d65096bb6f6a9360f6b3bba34fc1 -->
 ## [0.8.2] - 2026-08-23
 

package/CHANGELOG.zh-CN.md

@@ -1,5 +1,38 @@
 # 变更日志
 
+<!-- release-skill:changelog:start version=0.8.4 locale=zh-CN baseline=sha256:38a973bb735c925e8453656ce24a11173b530c6376609d68dfb850d9029daa21 -->
+## [0.8.4] - 2026-08-24
+
+随 Foundation 0.8.4 锁步升版，补充外置 source authority 校验用法；Kit 命令与 Profile SPI 不变。
+
+### 变更
+
+- 包版本与 Contracts、Harness 一同升至 0.8.4。
+- 说明消费者先经 Contracts 校验 source-authority receipt，再把返回坐标传入既有 sourceRepository 与 sourceBaseCommit 字段。
+- 四个稳定顶层命令、builder、Profile SPI 与公共导出保持不变。
+
+### 升级说明
+
+消费者必须把三个 Foundation 包精确锁定到 0.8.4。provider Profile descriptor 从 0.8.3 与 Contracts 1.7.0 升级时，必须把自身的 base.contractsVersion 字段机械更新为 1.8.0。既有函数与 Schema 形状、Profile SPI v3、Kit 四命令均不需要迁移；需要 source authority 的消费者只增加调用 builder 前的 Contracts 校验步骤。
+<!-- release-skill:changelog:end version=0.8.4 locale=zh-CN -->
+
+
+<!-- release-skill:changelog:start version=0.8.3 locale=zh-CN baseline=sha256:3315d4594a7e28926b54dae3057c35d192b1e9293d07d22fd8856f44da2a7d80 -->
+## [0.8.3] - 2026-08-23
+
+随 Foundation 0.8.3 锁步升版；受管 Bundle 携带 Harness 的有界路径收容修复。
+
+### 变更
+
+- 包版本与 Contracts、Harness 一同升至 0.8.3；Kit 的四个稳定顶层命令与 Profile SPI 均保持不变。
+- 重建受管 Bundle 会投影更新后的 Harness paths 模块，包括仅一次 ENOENT 锚点重求和保持不变的失败关闭边界。
+
+### 升级说明
+
+消费者必须把 Contracts、Harness 和 Engineering Kit 精确锁定到 0.8.3，再重建受管 Bundle；无需迁移 Kit API 或 Profile SPI。
+<!-- release-skill:changelog:end version=0.8.3 locale=zh-CN -->
+
+
 <!-- release-skill:changelog:start version=0.8.2 locale=zh-CN baseline=sha256:620f03e3fc81c1ef06d23b99fb0e70e547d58f3c6e956691b9c4a05e1b517c3b -->
 ## [0.8.2] - 2026-08-23
 

package/README.md

@@ -4,27 +4,24 @@
 
 # skill-family-engineering-kit
 
-<!-- release-skill:release-version: 0.8.2 -->
+<!-- release-skill:release-version: 0.8.4 -->
 
 An engineering toolkit used in development and CI. There are **exactly four** top-level commands, and no fifth:
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.8.2** (2026-08-23)
+**0.8.4** (2026-08-24)
 
-Managed offline Bundles now carry the strict-read source required by the fixed candidate mechanism bridge.
-
-**Added**
-
-- Projects strict-read.mjs into the managed Bundle and maps its closure, errors, and paths dependencies to sibling runtime modules.
-- Records the real strict-read.mjs source in Foundation provenance and verifies the read-file-strict bridge in an offline runner.
+Lockstep Foundation 0.8.4 update documents validated external source authority without changing Kit commands or Profile SPI.
 
 **Changed**
 
-- Moves the package version to 0.8.2 together with Contracts and Harness; the four stable top-level Kit commands remain unchanged.
+- Moves the package version to 0.8.4 together with Contracts and Harness.
+- Documents that consumers validate a source-authority receipt through Contracts before passing the returned coordinates through the existing sourceRepository and sourceBaseCommit fields.
+- Keeps the four stable top-level Kit commands, builder, Profile SPI, and public exports unchanged.
 
 **Upgrade Notes**
 
-Consumers must pin Contracts, Harness, and Engineering Kit to exactly 0.8.2 and rebuild the managed Bundle. Existing Bundles do not gain read-file-strict by changing a worktree reference.
+Pin all three Foundation packages to exactly 0.8.4. A provider Profile descriptor upgrading from 0.8.3 and Contracts 1.7.0 must mechanically update its base.contractsVersion field to 1.8.0. Existing functions and Schema shapes, Profile SPI v3, and the four Kit commands require no migration; source-authority consumers only add the Contracts validation step before invoking the existing builder surface.
 <!-- release-skill:managed:end id=latest-release -->
 
 | Command | Purpose | Side effects |
@@ -45,7 +42,7 @@ Kit is the "engineering stage" layer, depending on the Harness and Contracts. It
 ## Installation and Minimal Example
 
 ```sh
-npm install --save-dev skill-family-engineering-kit@0.8.2
+npm install --save-dev skill-family-engineering-kit@0.8.4
 npm exec -- skill-family-kit --help
 npm exec -- skill-family-kit scaffold --root <empty-dir> --project-id my-project
 npm exec -- skill-family-kit adopt-plan --root <repo>
@@ -53,7 +50,7 @@ npm exec -- skill-family-kit projection --root <repo>
 npm exec -- skill-family-kit check --root <repo>
 ```
 
-The four commands above cover skeleton generation, read-only inventory, managed projection, and diagnostics respectively; a zero-install form is available via `npm exec --package=skill-family-engineering-kit@0.8.2 -- skill-family-kit --help`.
+The four commands above cover skeleton generation, read-only inventory, managed projection, and diagnostics respectively; a zero-install form is available via `npm exec --package=skill-family-engineering-kit@0.8.4 -- skill-family-kit --help`.
 
 ### Public Profile SPI
 
@@ -63,6 +60,8 @@ The package carries three SPI JSON resources and the Contracts canonical `profil
 
 `verifyProfile({ profileRoot })` is read-only and data-only for Profile descriptors. `verifyProjectProfile({ projectRoot, profileRelPath? })` is the corresponding entry for a project root declaration. Both refuse invalid input with stable result codes, never execute Profile-provided files, and leave Profile domain meaning to the caller.
 
+When a provider Profile descriptor moves from Foundation 0.8.3 and Contracts 1.7.0 to Foundation 0.8.4, update its `base.contractsVersion` field mechanically to `1.8.0`. Functions and Schema shapes, Profile SPI v3, and all four Kit commands retain their existing shapes.
+
 ### Report sub-action
 
 ```sh
@@ -77,13 +76,22 @@ The caller must first construct a valid report model; Kit does not derive facts
 Use the candidate subpath to build a deterministic Quickstart Profile v2 projection from explicit consumer schemas and frozen source identity:
 
 ```js
+import { parseSourceAuthorityReceipt } from "skill-family-contracts";
 import {
   buildQuickstartProfileProjection,
   QUICKSTART_PROFILE_TARGET_PREFIX,
 } from "skill-family-engineering-kit/candidate/quickstart-profile";
+
+const authority = parseSourceAuthorityReceipt(receipt, actualSubjects);
+if (!authority.valid) throw new Error(authority.errorCode);
+
+const projection = await buildQuickstartProfileProjection({
+  ...projectionInputs,
+  ...authority.data,
+});
 ```
 
-The generated Bundle selects standalone validators by schema `$id` and runs offline without Foundation packages, `node_modules`, or runtime Ajv. Its provenance binds Foundation sources, consumer schemas, payload bytes, tool versions, and the licenses of code that actually enters the Bundle.
+The caller obtains `receipt` and `actualSubjects` outside Kit. Contracts validates their exact binding before the existing builder receives `sourceRepository` and `sourceBaseCommit`; Kit does not parse release plans or discover source authority. The generated Bundle selects standalone validators by schema `$id` and runs offline without Foundation packages, `node_modules`, or runtime Ajv. Its provenance binds Foundation sources, consumer schemas, payload bytes, tool versions, and the licenses of code that actually enters the Bundle.
 
 Pass the returned `manifest` to the stable `runProjection` API; the helper does not write files or add a fifth top-level command. This subpath is public but **not stable**. Pin exactly `0.4.0` for v2; integrations that still require the v1 dependency-closure Bundle must stay pinned to exactly `0.2.1`.
 

package/README.zh-CN.md

@@ -5,27 +5,24 @@
 
 # skill-family-engineering-kit
 
-<!-- release-skill:release-version: 0.8.2 -->
+<!-- release-skill:release-version: 0.8.4 -->
 
 开发与 CI 阶段使用的工程工具包。**恰好四个**顶层命令，没有第五个：
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.8.2** (2026-08-23)
+**0.8.4** (2026-08-24)
 
-受管离线 Bundle 现在携带固定候选机制桥接所需的 strict-read 源码。
-
-**新增**
-
-- 把 strict-read.mjs 投影进受管 Bundle，并把它的 closure、errors 和 paths 依赖映射到相邻运行时模块。
-- 在 Foundation provenance 中记录真实 strict-read.mjs 源码，并通过离线 runner 复验 read-file-strict。
+随 Foundation 0.8.4 锁步升版，补充外置 source authority 校验用法；Kit 命令与 Profile SPI 不变。
 
 **变更**
 
-- 包版本与 Contracts、Harness 一同升至 0.8.2；Kit 的四个稳定顶层命令保持不变。
+- 包版本与 Contracts、Harness 一同升至 0.8.4。
+- 说明消费者先经 Contracts 校验 source-authority receipt，再把返回坐标传入既有 sourceRepository 与 sourceBaseCommit 字段。
+- 四个稳定顶层命令、builder、Profile SPI 与公共导出保持不变。
 
 **升级说明**
 
-消费者必须把 Contracts、Harness 和 Engineering Kit 精确锁定到 0.8.2，再重建受管 Bundle。修改工作树引用不会让已有 Bundle 获得 read-file-strict。
+消费者必须把三个 Foundation 包精确锁定到 0.8.4。provider Profile descriptor 从 0.8.3 与 Contracts 1.7.0 升级时，必须把自身的 base.contractsVersion 字段机械更新为 1.8.0。既有函数与 Schema 形状、Profile SPI v3、Kit 四命令均不需要迁移；需要 source authority 的消费者只增加调用 builder 前的 Contracts 校验步骤。
 <!-- release-skill:managed:end id=latest-release -->
 
 | 命令 | 用途 | 副作用 |
@@ -46,7 +43,7 @@ Kit 是「工程阶段」层，依赖 Harness 与 Contracts。它只做四件事
 ## 安装和最小示例
 
 ```sh
-npm install --save-dev skill-family-engineering-kit@0.8.2
+npm install --save-dev skill-family-engineering-kit@0.8.4
 npm exec -- skill-family-kit --help
 npm exec -- skill-family-kit scaffold --root <empty-dir> --project-id my-project
 npm exec -- skill-family-kit adopt-plan --root <repo>
@@ -54,7 +51,7 @@ npm exec -- skill-family-kit projection --root <repo>
 npm exec -- skill-family-kit check --root <repo>
 ```
 
-以上四条命令分别覆盖生成骨架、只读盘点、受管投影与诊断；零安装形式可用 `npm exec --package=skill-family-engineering-kit@0.8.2 -- skill-family-kit --help`。
+以上四条命令分别覆盖生成骨架、只读盘点、受管投影与诊断；零安装形式可用 `npm exec --package=skill-family-engineering-kit@0.8.4 -- skill-family-kit --help`。
 
 ### 公共 Profile SPI
 
@@ -64,6 +61,8 @@ npm exec -- skill-family-kit check --root <repo>
 
 `verifyProfile({ profileRoot })` 只读处理 Profile descriptor；项目根声明使用对应的 `verifyProjectProfile({ projectRoot, profileRelPath? })`。两个入口遇到无效输入都以稳定结果码失败关闭，不会执行 Profile 提供的文件；Profile 的领域含义仍由调用方负责。
 
+provider Profile descriptor 从 Foundation 0.8.3 与 Contracts 1.7.0 升级到 Foundation 0.8.4 时，须把自身的 `base.contractsVersion` 字段机械更新为 `1.8.0`。既有函数与 Schema 形状、Profile SPI v3、Kit 四命令的形状均不变。
+
 ### 报告子动作
 
 ```sh
@@ -78,13 +77,22 @@ npm exec -- skill-family-kit check report --root <repo> --report <report.md> --m
 需要从显式消费者 Schema 与冻结来源身份生成确定性的 Quickstart Profile v2 投影时，使用 candidate 子路径：
 
 ```js
+import { parseSourceAuthorityReceipt } from "skill-family-contracts";
 import {
   buildQuickstartProfileProjection,
   QUICKSTART_PROFILE_TARGET_PREFIX,
 } from "skill-family-engineering-kit/candidate/quickstart-profile";
+
+const authority = parseSourceAuthorityReceipt(receipt, actualSubjects);
+if (!authority.valid) throw new Error(authority.errorCode);
+
+const projection = await buildQuickstartProfileProjection({
+  ...projectionInputs,
+  ...authority.data,
+});
 ```
 
-生成的 Bundle 按 Schema `$id` 选择 standalone validator，离线运行时不依赖 Foundation 包、`node_modules` 或 Ajv。provenance 绑定 Foundation 来源、消费者 Schema、payload 字节、工具版本，以及实际进入 Bundle 的代码许可证。
+`receipt` 与 `actualSubjects` 由调用方在 Kit 外取得。Contracts 先精确核对两者，既有 builder 再接收返回的 `sourceRepository` 与 `sourceBaseCommit`；Kit 不解析发布计划，也不发现来源权威。生成的 Bundle 按 Schema `$id` 选择 standalone validator，离线运行时不依赖 Foundation 包、`node_modules` 或 Ajv。provenance 绑定 Foundation 来源、消费者 Schema、payload 字节、工具版本，以及实际进入 Bundle 的代码许可证。
 
 以上辅助函数不写文件，也不增加第五个顶层命令。调用方需要把返回的 `manifest` 交给稳定的 `runProjection` API。该子路径公开但**不稳定**；使用 v2 时应精确锁定 `0.4.0`，仍依赖 v1 依赖闭包 Bundle 的接入必须继续精确锁定 `0.2.1`。
 

package/docs/agents/capability-catalog.en.json

@@ -1967,7 +1967,7 @@
     "Need a compatibility-frozen Quickstart API"
    ],
    "prerequisites": [
-    "Pin skill-family-contracts, skill-family-harness-node, and skill-family-engineering-kit to exactly 0.8.2 and rebuild the managed Bundle",
+    "Pin skill-family-contracts, skill-family-harness-node, and skill-family-engineering-kit to exactly 0.8.3 and rebuild the managed Bundle",
     "Observation and read-file-strict paths are contained under the caller-supplied root"
    ],
    "inputs": [
@@ -2015,7 +2015,7 @@
     "Need to bypass target manifest authorization or handwritten-file protection"
    ],
    "prerequisites": [
-    "Install exact matching 0.8.2 versions of all three Foundation packages",
+    "Install exact matching 0.8.3 versions of all three Foundation packages",
     "The target prefix is a contained relative POSIX path"
    ],
    "inputs": [
@@ -2037,7 +2037,7 @@
    ],
    "invariants": [
     "The Bundle contains no node_modules or runtime Ajv and runs without installed Foundation packages or network access",
-    "The managed Bundle is rebuilt from installed 0.8.2 package bytes and never imports source from a Foundation worktree",
+    "The managed Bundle is rebuilt from installed 0.8.3 package bytes and never imports source from a Foundation worktree",
     "The helper adds no top-level Kit command and never bypasses runProjection",
     "Stability is candidate: a later minor release may change or remove this subpath"
    ],

package/docs/agents/capability-catalog.zh-CN.json

@@ -1967,7 +1967,7 @@
     "需要兼容性已冻结的 Quickstart API"
    ],
    "prerequisites": [
-    "把 skill-family-contracts、skill-family-harness-node 与 skill-family-engineering-kit 精确锁定到 0.8.2，并重建受管 Bundle",
+    "把 skill-family-contracts、skill-family-harness-node 与 skill-family-engineering-kit 精确锁定到 0.8.3，并重建受管 Bundle",
     "observation 路径与 read-file-strict 路径受调用方提供的 root 收容"
    ],
    "inputs": [
@@ -2015,7 +2015,7 @@
     "需要绕过目标 manifest 授权或手写文件保护"
    ],
    "prerequisites": [
-    "安装精确匹配的三个 Foundation 0.8.2 包版本",
+    "安装精确匹配的三个 Foundation 0.8.3 包版本",
     "targetPrefix 是受收容的 POSIX 相对路径"
    ],
    "inputs": [
@@ -2037,7 +2037,7 @@
    ],
    "invariants": [
     "Bundle 不含 node_modules 或运行时 Ajv，不依赖已安装 Foundation 包或网络",
-    "受管 Bundle 从 0.8.2 的已安装包字节重建，不从 Foundation 工作树导入源码",
+    "受管 Bundle 从 0.8.3 的已安装包字节重建，不从 Foundation 工作树导入源码",
     "辅助函数不增加 Kit 顶层命令，也不绕过 runProjection",
     "稳定性为 candidate：后续小版本可以修改或移除该子路径"
    ],

package/docs/architecture/index.html

@@ -1972,7 +1972,7 @@ Contracts（结构、协议、错误码、协议名登记）
 <tbody>
 <tr>
 <td>Contracts</td>
-<td>结构、协议、错误码、协议名登记；24 类顶层对象；9 条 mandatory rule</td>
+<td>结构、协议、错误码、协议名登记；32 类顶层对象；9 条 mandatory rule</td>
 <td>业务字段语义、领域审计、远端写入、模型生成</td>
 </tr>
 <tr>
@@ -2077,12 +2077,12 @@ Contracts（结构、协议、错误码、协议名登记）
 <p>三包结构保持、不拆第四包（FND-ADR-007）；制品治理采用 artifact-graph CLI 与版本锁（FND-ADR-006）。</p>
 <h2 id="首版预算">首版预算<a class="headerlink" href="#首版预算" title="Permanent link">&para;</a></h2>
 <ul>
-<li>顶层 Contracts 对象：31 类（完整清单以 <code>packages/skill-family-contracts/src/registry.json</code> 为唯一真源）：project-manifest、profile-descriptor、project-profile（FND-ADR-013，1.7.0 纳入）、managed-file-lock、operation-request、operation-result、migration-manifest、adapter-source、report-model、report-binding、host-descriptor、host-registry、host-capability-fact、host-probe-result、adapter-build-manifest、host-operation-plan、host-operation-receipt、state-event-envelope、state-snapshot-metadata、token-estimate-result、surface-scan-policy、declared-read-surface-result、structured-scan-policy（FND-ADR-010/011）、timeout-policy、watchdog-termination-envelope（FND-ADR-012，append-only 保持 1.5.0）、public-boundary-declaration、platform-difference-registry、observation-scope、profile-adoption-declaration、audit-baseline-pin、token-estimate-record（审计规则裁决与整改 1.6.0 纳入）；</li>
+<li>顶层 Contracts 对象：32 类（完整清单以 <code>packages/skill-family-contracts/src/registry.json</code> 为唯一真源）：project-manifest、profile-descriptor、project-profile（FND-ADR-013，1.7.0 纳入）、managed-file-lock、operation-request、operation-result、migration-manifest、adapter-source、report-model、report-binding、host-descriptor、host-registry、host-capability-fact、host-probe-result、adapter-build-manifest、host-operation-plan、host-operation-receipt、state-event-envelope、state-snapshot-metadata、token-estimate-result、surface-scan-policy、declared-read-surface-result、structured-scan-policy（FND-ADR-010/011）、timeout-policy、watchdog-termination-envelope（FND-ADR-012，append-only 保持 1.5.0）、public-boundary-declaration、platform-difference-registry、observation-scope、profile-adoption-declaration、audit-baseline-pin、token-estimate-record（审计规则裁决与整改 1.6.0 纳入）、source-authority-receipt（1.8.0 纳入）；</li>
 <li>Kit 顶层命令：4 个（scaffold、adopt-plan、projection、check）；</li>
 <li>强制机械规则：当前 9 条，预算不超过 20 条，绝对上限 30 条；CR-001 对登记表内全部 Schema 做统一编译；</li>
 <li>叶子包：3 个（skill-family-contracts、skill-family-harness-node、skill-family-engineering-kit）；</li>
 <li>Schema 校验器：Ajv 8.20.0（精确版本 pin），支持 draft-07 与 2020-12 双方言；</li>
-<li>kernel 协议：skill-family.kernel.operation（stable），Contracts 版本 1.7.0；</li>
+<li>kernel 协议：skill-family.kernel.operation（stable），Contracts 版本 1.8.0；</li>
 <li>默认运行时语言：Node；第二语言实现首版为 0。</li>
 </ul>
 <p>任何新增组件必须说明删除它会导致的两个以上真实消费者重复实现，并通过独立 fixture 验证。</p>

package/docs/integration/audit/index.html

@@ -1796,7 +1796,7 @@
   isolation-and-lockfile.md     隔离安装与包锁验证设计
   independence.md               独立性声明与机械证明
   schemas/audit-evidence.schema.json   证据文档的 JSON Schema（审计自有）
-  baseline/contracts-1.7.0.pin.json    Contracts 1.7.0 当前候选基线 pin（摘要+事实）
+  baseline/contracts-1.8.0.pin.json    Contracts 1.8.0 当前候选基线 pin（摘要+事实）
   baseline/contracts-1.6.0.pin.json    Contracts 1.6.0 只读兼容存档 pin
   baseline/contracts-1.5.0.pin.json    Contracts 1.5.0 只读兼容存档 pin
   baseline/contracts-1.1.1.pin.json    Contracts 1.1.1 只读兼容存档 pin

package/docs/integration/audit/version-compatibility/index.html

@@ -1791,7 +1791,7 @@
 <tbody>
 <tr>
 <td><code>contractsVersion</code></td>
-<td>Contracts 冻结版本（当前 <code>1.7.0</code>）</td>
+<td>Contracts 冻结版本（当前 <code>1.8.0</code>）</td>
 <td>机器契约内容的版本</td>
 </tr>
 <tr>
@@ -1806,7 +1806,7 @@
 </tr>
 </tbody>
 </table>
-<p>三者都由 <code>describeAuditSurface()</code> 一次性给出，审计侧把它们与基线 pin（当前为 <code>baseline/contracts-1.7.0.pin.json</code>）比对。</p>
+<p>三者都由 <code>describeAuditSurface()</code> 一次性给出，审计侧把它们与基线 pin（当前为 <code>baseline/contracts-1.8.0.pin.json</code>）比对。</p>
 <h2 id="兼容规则">兼容规则<a class="headerlink" href="#兼容规则" title="Permanent link">&para;</a></h2>
 <p>一个被消费的 Contracts 包与某个基线 pin <strong>兼容</strong>，当且仅当同时满足：</p>
 <ol>
@@ -1864,7 +1864,8 @@
 <li><strong>Contracts 1.4.0（2026-08-09）</strong>：持久状态能力线增量，不是描述补丁：新增 <code>state-event-envelope</code>、<code>state-snapshot-metadata</code> 两个顶层契约，改变了公开机器合同与审计事实。</li>
 <li><strong>Contracts 1.5.0（2026-08-16）</strong>：FND-ADR-010/011 能力线增量，不是描述补丁：新增 <code>declared-read-surface-result</code>、<code>structured-scan-policy</code> 两个顶层契约（顶层对象集合 20 → 22），改变了公开机器合同与审计事实。该 pin 的摘要与事实均从当前 <code>describeAuditSurface()/digestAuditSurface()</code> 机械投影，provenance 仍为 <code>product-compatibility-fixture</code>。</li>
 <li><strong>Contracts 1.6.0（2026-08-18）</strong>：审计整改 C5 能力线增量，不是描述补丁：新增 <code>public-boundary-declaration</code>、<code>platform-difference-registry</code>、<code>observation-scope</code>、<code>profile-adoption-declaration</code>、<code>audit-baseline-pin</code>、<code>token-estimate-record</code> 六个顶层契约（顶层对象集合 24 → 30），改变了公开机器合同与审计事实；未新增 SFC 错误码，规则与 kernel 协议仅随 <code>contractsVersion</code> 字段更新。pin 合同本身（<code>audit-baseline-pin</code>）与消费面校验函数 <code>verifyBaselinePin()</code>（AUD-BASE-001 / AUD-LOCK-001 编码）在本版本落地（GAP-5 / SG-28）。</li>
-<li><strong>Contracts 1.7.0（2026-08-22）</strong>：FND-ADR-013 的 Project Profile 能力线增量。新增 <code>project-profile</code> 顶层契约（顶层对象集合 30 → 31），统一 scaffold 项目根声明的机器结构；未新增 SFC 错误码。<code>contracts-1.7.0.pin.json</code> 是当前候选基线，由 <code>scripts/baseline-pin-gen.mjs --update</code> 从 <code>describeAuditSurface()/describeBaselinePin()</code> 机械生成，并经过合同校验和 <code>verifyBaselinePin()</code> 自校验。1.6.0 及更早 pin 保留为只读兼容存档。</li>
+<li><strong>Contracts 1.7.0（2026-08-22）</strong>：FND-ADR-013 的 Project Profile 能力线增量。新增 <code>project-profile</code> 顶层契约（顶层对象集合 30 → 31），统一 scaffold 项目根声明的机器结构；未新增 SFC 错误码。<code>contracts-1.7.0.pin.json</code> 由 <code>scripts/baseline-pin-gen.mjs --update</code> 从 <code>describeAuditSurface()/describeBaselinePin()</code> 机械生成，并经过合同校验和 <code>verifyBaselinePin()</code> 自校验；现作为历史只读兼容存档保留。</li>
+<li><strong>Contracts 1.8.0（2026-08-24）</strong>：新增业务中立的 <code>source-authority-receipt</code> 顶层契约（31 → 32），以及纯校验、解析 API；未新增 SFC 错误码。<code>contracts-1.8.0.pin.json</code> 由 <code>scripts/baseline-pin-gen.mjs --update</code> 从公开 Contracts 表面机械生成并自校验；1.7.0 及更早 pin 保留为只读兼容存档。</li>
 <li>审计运行时先做包锁验证（见 isolation-and-lockfile.md），再做变异重放；pin 不匹配时，变异重放结果不得被采信。</li>
 </ul>
 <h2 id="profile-行为变更纪律2026-08-19D6">profile 行为变更纪律（2026-08-19，D6）<a class="headerlink" href="#profile-行为变更纪律2026-08-19D6" title="Permanent link">&para;</a></h2>

package/docs/public/status/index.html

@@ -1792,17 +1792,17 @@
 <tbody>
 <tr>
 <td><code>skill-family-contracts</code></td>
-<td>0.8.2</td>
+<td>0.8.4</td>
 <td><a href="https://github.com/ifoohoo/skill-family-contracts">ifoohoo/skill-family-contracts</a></td>
 </tr>
 <tr>
 <td><code>skill-family-harness-node</code></td>
-<td>0.8.2</td>
+<td>0.8.4</td>
 <td><a href="https://github.com/ifoohoo/skill-family-harness-node">ifoohoo/skill-family-harness-node</a></td>
 </tr>
 <tr>
 <td><code>skill-family-engineering-kit</code></td>
-<td>0.8.2</td>
+<td>0.8.4</td>
 <td><a href="https://github.com/ifoohoo/skill-family-engineering-kit">ifoohoo/skill-family-engineering-kit</a></td>
 </tr>
 </tbody>

package/docs/reference/api/contracts/index.html

@@ -715,6 +715,34 @@
       </ul>
     </nav>
 
+</li>
+
+        <li class="md-nav__item">
+  <a href="#来源权威收据-foundationcontractssource-authority" class="md-nav__link">
+    <span class="md-ellipsis">
+
+        来源权威收据 (foundation.contracts.source-authority)
+
+    </span>
+  </a>
+
+    <nav class="md-nav" aria-label="来源权威收据 (foundation.contracts.source-authority)">
+      <ul class="md-nav__list">
+
+          <li class="md-nav__item">
+  <a href="#validateSourceAuthorityReceipt--parseSourceAuthorityReceipt" class="md-nav__link">
+    <span class="md-ellipsis">
+
+        validateSourceAuthorityReceipt / parseSourceAuthorityReceipt
+
+    </span>
+  </a>
+
+</li>
+
+      </ul>
+    </nav>
+
 </li>
 
         <li class="md-nav__item">
@@ -1972,6 +2000,34 @@
       </ul>
     </nav>
 
+</li>
+
+        <li class="md-nav__item">
+  <a href="#来源权威收据-foundationcontractssource-authority" class="md-nav__link">
+    <span class="md-ellipsis">
+
+        来源权威收据 (foundation.contracts.source-authority)
+
+    </span>
+  </a>
+
+    <nav class="md-nav" aria-label="来源权威收据 (foundation.contracts.source-authority)">
+      <ul class="md-nav__list">
+
+          <li class="md-nav__item">
+  <a href="#validateSourceAuthorityReceipt--parseSourceAuthorityReceipt" class="md-nav__link">
+    <span class="md-ellipsis">
+
+        validateSourceAuthorityReceipt / parseSourceAuthorityReceipt
+
+    </span>
+  </a>
+
+</li>
+
+      </ul>
+    </nav>
+
 </li>
 
         <li class="md-nav__item">
@@ -2197,6 +2253,7 @@
 <p>能力分组（与 <code>docs/agents/capability-catalog.json</code> 对应）：</p>
 <ul>
 <li><a href="#对象校验-foundationcontractsobject-validation">对象校验</a> → <code>validateDocument</code> / <code>compileSchema</code> / <code>detectDialect</code></li>
+<li><a href="#来源权威收据-foundationcontractssource-authority">来源权威收据</a> → <code>validateSourceAuthorityReceipt</code> / <code>parseSourceAuthorityReceipt</code></li>
 <li><a href="#登记与协议-foundationcontractsregistry-protocol">登记与协议</a> → <code>loadRegistry</code> / <code>findSchemaByObject</code> / <code>findProtocol</code> / <code>registerSchema</code> / <code>registerProtocol</code></li>
 <li><a href="#内核协议-foundationcontractskernel-protocol">内核协议</a> → <code>loadKernelProtocol</code> / <code>findOperation</code> / <code>checkOperation</code></li>
 <li><a href="#强制检查-foundationcontractsmandatory-checks">强制检查</a> → <code>runChecks</code> / <code>collectUnresolvedRefs</code></li>
@@ -2204,7 +2261,7 @@
 <li><a href="#错误码-foundationcontractserror-codes">错误码</a> → <code>ContractsError</code> / <code>isRegisteredErrorCode</code> / <code>stableError</code></li>
 <li><a href="#审计表面-foundationcontractsaudit-surface">审计表面</a> → <code>canonicalJson</code> / <code>digestDocument</code> / <code>digestAuditSurface</code></li>
 </ul>
-<p>包级常量（冻结，仅作事实投影，不另立权威）：<code>CONTRACT_OBJECTS</code>（18 类顶层对象，闭集）、<code>CONTRACT_BOUNDARY</code>、<code>CONTRACTS_VERSION = "1.4.0"</code>、<code>SUPPORTED_DIALECTS</code>、<code>VALIDATION_POLICIES</code>、<code>CHECK_TYPES</code>（9 类机械检查）、<code>MANDATORY_RULES</code>、<code>RULE_BUDGET</code>、<code>ERROR_CODES</code>。</p>
+<p>包级常量（冻结，仅作事实投影，不另立权威）：<code>CONTRACT_OBJECTS</code>（32 类顶层对象，闭集）、<code>CONTRACT_BOUNDARY</code>、<code>CONTRACTS_VERSION = "1.8.0"</code>、<code>SUPPORTED_DIALECTS</code>、<code>VALIDATION_POLICIES</code>、<code>CHECK_TYPES</code>（9 类机械检查）、<code>MANDATORY_RULES</code>、<code>RULE_BUDGET</code>、<code>ERROR_CODES</code>。</p>
 <hr />
 <h2 id="对象校验-foundationcontractsobject-validation">对象校验 (foundation.contracts.object-validation)<a class="headerlink" href="#对象校验-foundationcontractsobject-validation" title="Permanent link">&para;</a></h2>
 <h3 id="validateDocument">validateDocument<a class="headerlink" href="#validateDocument" title="Permanent link">&para;</a></h3>
@@ -2251,6 +2308,22 @@
 <li>调用方仍拥有的业务语义：方言选择策略（何时用 tolerant）。</li>
 </ul>
 <hr />
+<h2 id="来源权威收据-foundationcontractssource-authority">来源权威收据 (foundation.contracts.source-authority)<a class="headerlink" href="#来源权威收据-foundationcontractssource-authority" title="Permanent link">&para;</a></h2>
+<h3 id="validateSourceAuthorityReceipt--parseSourceAuthorityReceipt">validateSourceAuthorityReceipt / parseSourceAuthorityReceipt<a class="headerlink" href="#validateSourceAuthorityReceipt--parseSourceAuthorityReceipt" title="Permanent link">&para;</a></h3>
+<ul>
+<li>签名：<code>validateSourceAuthorityReceipt(receipt)</code>；<code>parseSourceAuthorityReceipt(receipt, actualSubjects)</code>。</li>
+<li>输入：闭合的外置 receipt，以及调用方实际观测的 subjects。每个 subject 只含 <code>packageName</code>、<code>version</code>、<code>filename</code> 与 <code>sha256</code>。</li>
+<li>输出：两者均返回既有 <code>{ valid, errorCode, errors, data }</code> 结果形态。解析成功时，<code>data</code> 只含 <code>sourceRepository</code> 与 <code>sourceBaseCommit</code>。</li>
+<li>纯函数：是。输入会复制后校验，调用方对象不被修改。</li>
+<li>副作用：无文件、进程、Git、网络或发布状态副作用。</li>
+<li>稳定错误码：结构、排序、重复包名、实际 subjects 形状或逐字段核对失败均返回 <code>SFC1001</code>。</li>
+<li>前置条件与信任锚：receipt subjects 至少一项，按 <code>packageName</code> 唯一、升序排列；<code>sourceBaseCommit</code> 是 40 位小写十六进制，SHA-256 是 64 位小写十六进制。调用方负责取得 receipt 与实际 subjects。</li>
+<li><code>since</code> / <code>stability</code>：<code>0.8.4</code> / <code>stable</code>。</li>
+<li>源文件：<code>packages/skill-family-contracts/src/source-authority.mjs</code>、<code>src/schemas/source-authority-receipt.schema.json</code>。</li>
+<li>正例/负例测试：<code>packages/skill-family-contracts/test/source-authority.test.mjs</code>、<code>source-authority-public-consumer.test.mjs</code>。</li>
+<li>调用方仍拥有的业务语义：receipt 的签发、存储和传输；实际包发现；校验后是否采用该来源。Contracts 不执行目标，也不解释私有发布计划。</li>
+</ul>
+<hr />
 <h2 id="登记与协议-foundationcontractsregistry-protocol">登记与协议 (foundation.contracts.registry-protocol)<a class="headerlink" href="#登记与协议-foundationcontractsregistry-protocol" title="Permanent link">&para;</a></h2>
 <h3 id="loadRegistry--listSchemas--listProtocols--findSchemaRegistration--findSchemaByObject--findProtocol">loadRegistry / listSchemas / listProtocols / findSchemaRegistration / findSchemaByObject / findProtocol<a class="headerlink" href="#loadRegistry--listSchemas--listProtocols--findSchemaRegistration--findSchemaByObject--findProtocol" title="Permanent link">&para;</a></h3>
 <ul>

package/docs/reference/api/engineering-kit/index.html

@@ -2375,6 +2375,8 @@
 <h1 id="skill-family-engineering-kit-公共-API-参考">skill-family-engineering-kit 公共 API 参考<a class="headerlink" href="#skill-family-engineering-kit-公共-API-参考" title="Permanent link">&para;</a></h1>
 <p>本页从真实导出（<code>src/index.mjs</code> 与各源模块、CLI 入口）核对，不手写无法证明新鲜度的全集。每个公共入口按 hand-off §4.3 说明：签名、输入与输出、是否纯函数、文件/进程/Git/网络副作用、稳定错误码与 <code>details.kind</code>、前置条件与信任锚、<code>since</code> 与 <code>stability</code>、源文件与正例/负例测试、调用方仍拥有的业务语义。</p>
 <p>Kit 消费 Contracts 与 Harness，只拥有四个顶层命令与它们的只读/受控写边界。包级常量：<code>TOP_LEVEL_COMMANDS</code>（冻结 4 个：<code>scaffold</code> / <code>adopt-plan</code> / <code>projection</code> / <code>check</code>）、<code>FORBIDDEN_SIDE_EFFECTS</code>、<code>COMMAND_SIDE_EFFECTS</code>、<code>KIT_EXIT_CODES</code>（<code>ok=0</code> / <code>findings=1</code> / <code>rejected=2</code>）。Kit 永不执行 Git 写、发布、删除用户内容或触网。</p>
+<p>外置 source authority 不增加 Kit API。调用方先用 Contracts <code>parseSourceAuthorityReceipt(receipt, actualSubjects)</code> 核对收据，再把成功结果中的 <code>sourceRepository</code> 与 <code>sourceBaseCommit</code> 传给既有 Quickstart builder。Kit 不读取私有发布 plan，不发现实际包，也不签发 receipt。</p>
+<p>provider Profile descriptor 从 Foundation 0.8.3 与 Contracts 1.7.0 升级到 Foundation 0.8.4 时，须把自身的 <code>base.contractsVersion</code> 字段机械更新为 <code>1.8.0</code>。既有函数与 Schema 形状、Profile SPI v3、Kit 四命令的形状均不变。</p>
 <p>能力分组（与 <code>docs/agents/capability-catalog.json</code> 对应）：</p>
 <ul>
 <li><a href="#scaffold-foundationkitscaffold">scaffold</a> → <code>scaffoldTarget</code></li>

package/docs/reference/api/harness/index.html

@@ -3166,7 +3166,7 @@
 <p><code>params</code> 是闭合对象。<code>root</code> 与 <code>path</code> 是必填非空字符串；<code>encoding</code> 只能是 <code>utf8</code> 或省略；<code>expectedSha256</code> 省略时不做预期摘要比对，提供时沿用核心严格读取合同。</p>
 <p>桥接保留核心回执的 <code>path</code>、<code>sha256</code>、<code>bytes</code> 与 <code>mode</code>。UTF-8 内容仍是字符串；二进制内容投影成 Node 标准的 Buffer JSON 形态 <code>{ "type": "Buffer", "data": [...] }</code>，以便通过 JSON 传输后无损还原字节。</p>
 <p>直接调用失败时沿用核心异常，包括 <code>SFC2004</code> 与 <code>details.kind</code>。候选 <code>mechanisms-cli.mjs</code> 继续使用一请求一响应 JSON：成功退出 0，拒绝或用法错误退出 2；CLI 错误 JSON 只承诺 <code>name</code> 与 <code>message</code>，不承诺跨语言保留 <code>details</code>。</p>
-<p>该入口不选择 method，不解释 domainResult，也不拥有重试、调度或生命周期。消费者必须把 Contracts、Harness 与 Engineering Kit 精确锁定到 0.8.2，并重建受管 Bundle；禁止从 Foundation 工作树导入候选源码。0.3.0 的 v2 与 0.2.1 的 v1 不兼容。</p>
+<p>该入口不选择 method，不解释 domainResult，也不拥有重试、调度或生命周期。消费者必须把 Contracts、Harness 与 Engineering Kit 精确锁定到 0.8.4，并重建受管 Bundle；禁止从 Foundation 工作树导入候选源码。0.3.0 的 v2 与 0.2.1 的 v1 不兼容。</p>
 <hr />
 <h2 id="与机器事实层的互链">与机器事实层的互链<a class="headerlink" href="#与机器事实层的互链" title="Permanent link">&para;</a></h2>
 <ul>