skill-family-engineering-kit 0.8.4 → 0.10.0

package/CHANGELOG.md

@@ -1,5 +1,47 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.10.0 locale=en baseline=sha256:fc575df3b8c5f7a0d819090ce9637f8cdc654c277892fe3f14149d5cc1746b24 -->
+## [0.10.0] - 2026-08-24
+
+Engineering Kit 0.10.0 adds responsibility-specific canonical entrypoints, a bounded host lifecycle slice, and a thin read-only peer adapter verification entry.
+
+### Added
+
+- Adds skill-family-engineering-kit/quickstart-profile, /adoption, and /skill-naming canonical exports.
+- Adds finite Profile alias resolution, independent manual probe facts for non-driver hosts, and explicit local install/update plans; uninstall remains a manual-recovery refusal.
+- Adds `verifyHostPeers` as a thin wrapper over Harness peer verification; the Kit retains four top-level commands and does not write peer directories.
+
+### Changed
+
+- Keeps the historical Quickstart candidate export as a same-source migration alias and preserves the four-command Kit boundary.
+- Compiles one canonical Quickstart and batch Schema set while mapping historical and canonical IDs to the same standalone validators.
+
+### Upgrade Notes
+
+Update all three exact pins to 0.10.0 and migrate imports and Schema IDs once to canonical identities. A later maturity-label promotion adds no separate Bundle rebuild requirement; package-identity, source-digest, and provenance changes continue to follow the existing projection contract.
+<!-- release-skill:changelog:end version=0.10.0 locale=en -->
+
+
+<!-- release-skill:changelog:start version=0.9.0 locale=en baseline=sha256:6419bbdc8d469e6dd7f9fda5995e5465cc6bf98724371f9f4aa9293a7e0d9f14 -->
+## [0.9.0] - 2026-08-24
+
+Engineering Kit 0.9.0 projects the stable filesystem schemas, bound-read Harness closure, and candidate ordered batch validation into the existing Quickstart Bundle.
+
+### Added
+
+- Projects the three stable filesystem schemas and two candidate batch schemas from Contracts authorities.
+- Projects the stable bound-read entry and its exact native prebuild closure without adding a Kit command.
+
+### Changed
+
+- Keeps the four top-level Kit commands and Profile SPI candidate boundary unchanged.
+
+### Upgrade Notes
+
+Pin all three Foundation packages to exactly 0.9.0 and rebuild managed Bundles. Batch validation is available only through the existing candidate Bundle and mechanisms CLI.
+<!-- release-skill:changelog:end version=0.9.0 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.8.4 locale=en baseline=sha256:0f6ad4e641ae6ef85ea323e458aa6263aa6d87280e704ac1324742f83016d779 -->
 ## [0.8.4] - 2026-08-24
 

package/CHANGELOG.zh-CN.md

@@ -1,5 +1,47 @@
 # 变更日志
 
+<!-- release-skill:changelog:start version=0.10.0 locale=zh-CN baseline=sha256:45180b7a3b60853842cbe3a379da7ff95f1bd1fe832192368ec2c92a813279dc -->
+## [0.10.0] - 2026-08-24
+
+Engineering Kit 0.10.0 为历史 candidate 提供职责明确的规范入口，增加受限的跨平台宿主身份、探针和本地生命周期能力，并提供同级适配器只读验证薄入口。
+
+### 新增
+
+- 新增 skill-family-engineering-kit/quickstart-profile、/adoption 与 /skill-naming 规范导出。
+- 增加有限 Profile alias 解析、非 driver 宿主的独立手动 probe fact 和显式本地 install/update 计划；uninstall 仍要求人工恢复。
+- 新增 `verifyHostPeers`，只包装 Harness 的 peer 验证，不增加第五个顶层命令，也不写入 peer 目录。
+
+### 变更
+
+- 历史 Quickstart candidate 导出继续作为同源迁移别名，Kit 四命令边界不变。
+- 只编译一套规范 Quickstart 与批量校验 Schema；历史和规范 ID 指向同一 standalone validator。
+
+### 升级说明
+
+消费者应把三个包的精确 pin 更新到 0.10.0，并把导入与 Schema ID 一次迁移到规范身份。以后仅晋升成熟度标签时不另加 Bundle 重建要求；包身份、来源摘要或 provenance 变化仍按既有投影合同处理。
+<!-- release-skill:changelog:end version=0.10.0 locale=zh-CN -->
+
+
+<!-- release-skill:changelog:start version=0.9.0 locale=zh-CN baseline=sha256:c84db7b53f562cbdad947ccf8fcc23209f18137100270b2691bab7d9a7ad623c -->
+## [0.9.0] - 2026-08-24
+
+Engineering Kit 0.9.0 将稳定文件系统 Schema、绑定读取 Harness 闭包与有序批量校验 candidate 投影到既有 Quickstart Bundle。
+
+### 新增
+
+- 从 Contracts 权威源投影三个稳定文件系统 Schema 与两个批量校验 candidate Schema。
+- 投影稳定绑定读取入口及其精确原生预构建闭包，不新增 Kit 命令。
+
+### 变更
+
+- 四个顶层 Kit 命令与 Profile SPI 的 candidate 边界保持不变。
+
+### 升级说明
+
+三个 Foundation 包必须精确锁定 0.9.0 并重新构建 managed Bundle；批量校验只能通过既有 candidate Bundle 与 mechanisms CLI 使用。
+<!-- release-skill:changelog:end version=0.9.0 locale=zh-CN -->
+
+
 <!-- release-skill:changelog:start version=0.8.4 locale=zh-CN baseline=sha256:38a973bb735c925e8453656ce24a11173b530c6376609d68dfb850d9029daa21 -->
 ## [0.8.4] - 2026-08-24
 

package/README.md

@@ -4,24 +4,29 @@
 
 # skill-family-engineering-kit
 
-<!-- release-skill:release-version: 0.8.4 -->
+<!-- release-skill:release-version: 0.10.0 -->
 
 An engineering toolkit used in development and CI. There are **exactly four** top-level commands, and no fifth:
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.8.4** (2026-08-24)
+**0.10.0** (2026-08-24)
 
-Lockstep Foundation 0.8.4 update documents validated external source authority without changing Kit commands or Profile SPI.
+Engineering Kit 0.10.0 adds responsibility-specific canonical entrypoints, a bounded host lifecycle slice, and a thin read-only peer adapter verification entry.
+
+**Added**
+
+- Adds skill-family-engineering-kit/quickstart-profile, /adoption, and /skill-naming canonical exports.
+- Adds finite Profile alias resolution, independent manual probe facts for non-driver hosts, and explicit local install/update plans; uninstall remains a manual-recovery refusal.
+- Adds `verifyHostPeers` as a thin wrapper over Harness peer verification; the Kit retains four top-level commands and does not write peer directories.
 
 **Changed**
 
-- Moves the package version to 0.8.4 together with Contracts and Harness.
-- Documents that consumers validate a source-authority receipt through Contracts before passing the returned coordinates through the existing sourceRepository and sourceBaseCommit fields.
-- Keeps the four stable top-level Kit commands, builder, Profile SPI, and public exports unchanged.
+- Keeps the historical Quickstart candidate export as a same-source migration alias and preserves the four-command Kit boundary.
+- Compiles one canonical Quickstart and batch Schema set while mapping historical and canonical IDs to the same standalone validators.
 
 **Upgrade Notes**
 
-Pin all three Foundation packages to exactly 0.8.4. A provider Profile descriptor upgrading from 0.8.3 and Contracts 1.7.0 must mechanically update its base.contractsVersion field to 1.8.0. Existing functions and Schema shapes, Profile SPI v3, and the four Kit commands require no migration; source-authority consumers only add the Contracts validation step before invoking the existing builder surface.
+Update all three exact pins to 0.10.0 and migrate imports and Schema IDs once to canonical identities. A later maturity-label promotion adds no separate Bundle rebuild requirement; package-identity, source-digest, and provenance changes continue to follow the existing projection contract.
 <!-- release-skill:managed:end id=latest-release -->
 
 | Command | Purpose | Side effects |
@@ -42,7 +47,7 @@ Kit is the "engineering stage" layer, depending on the Harness and Contracts. It
 ## Installation and Minimal Example
 
 ```sh
-npm install --save-dev skill-family-engineering-kit@0.8.4
+npm install --save-dev skill-family-engineering-kit@0.10.0
 npm exec -- skill-family-kit --help
 npm exec -- skill-family-kit scaffold --root <empty-dir> --project-id my-project
 npm exec -- skill-family-kit adopt-plan --root <repo>
@@ -50,7 +55,7 @@ npm exec -- skill-family-kit projection --root <repo>
 npm exec -- skill-family-kit check --root <repo>
 ```
 
-The four commands above cover skeleton generation, read-only inventory, managed projection, and diagnostics respectively; a zero-install form is available via `npm exec --package=skill-family-engineering-kit@0.8.4 -- skill-family-kit --help`.
+The four commands above cover skeleton generation, read-only inventory, managed projection, and diagnostics respectively; a zero-install form is available via `npm exec --package=skill-family-engineering-kit@0.10.0 -- skill-family-kit --help`.
 
 ### Public Profile SPI
 
@@ -60,7 +65,7 @@ The package carries three SPI JSON resources and the Contracts canonical `profil
 
 `verifyProfile({ profileRoot })` is read-only and data-only for Profile descriptors. `verifyProjectProfile({ projectRoot, profileRelPath? })` is the corresponding entry for a project root declaration. Both refuse invalid input with stable result codes, never execute Profile-provided files, and leave Profile domain meaning to the caller.
 
-When a provider Profile descriptor moves from Foundation 0.8.3 and Contracts 1.7.0 to Foundation 0.8.4, update its `base.contractsVersion` field mechanically to `1.8.0`. Functions and Schema shapes, Profile SPI v3, and all four Kit commands retain their existing shapes.
+When a provider Profile descriptor moves from Foundation 0.9.0 and Contracts 1.9.0 to Foundation 0.10.0, update its `base.contractsVersion` field mechanically to `1.10.0`. The four Kit commands and Profile SPI retain their existing shapes.
 
 ### Report sub-action
 
@@ -80,7 +85,7 @@ import { parseSourceAuthorityReceipt } from "skill-family-contracts";
 import {
   buildQuickstartProfileProjection,
   QUICKSTART_PROFILE_TARGET_PREFIX,
-} from "skill-family-engineering-kit/candidate/quickstart-profile";
+} from "skill-family-engineering-kit/quickstart-profile";
 
 const authority = parseSourceAuthorityReceipt(receipt, actualSubjects);
 if (!authority.valid) throw new Error(authority.errorCode);
@@ -93,7 +98,7 @@ const projection = await buildQuickstartProfileProjection({
 
 The caller obtains `receipt` and `actualSubjects` outside Kit. Contracts validates their exact binding before the existing builder receives `sourceRepository` and `sourceBaseCommit`; Kit does not parse release plans or discover source authority. The generated Bundle selects standalone validators by schema `$id` and runs offline without Foundation packages, `node_modules`, or runtime Ajv. Its provenance binds Foundation sources, consumer schemas, payload bytes, tool versions, and the licenses of code that actually enters the Bundle.
 
-Pass the returned `manifest` to the stable `runProjection` API; the helper does not write files or add a fifth top-level command. This subpath is public but **not stable**. Pin exactly `0.4.0` for v2; integrations that still require the v1 dependency-closure Bundle must stay pinned to exactly `0.2.1`.
+Pass the returned `manifest` to the stable `runProjection` API; the helper does not write files or add a fifth top-level command. The capability remains **candidate**, so pin all three packages exactly. Version 0.10.0 adds the canonical path above; the historical `/candidate/quickstart-profile` path remains a same-source migration alias. Adoption and skill naming now also have the canonical `skill-family-engineering-kit/adoption` and `skill-family-engineering-kit/skill-naming` paths. A later stable promotion will not require a second migration. Integrations that still require the v1 dependency-closure Bundle must stay pinned to exactly `0.2.1`.
 
 ### Host sub-action
 
@@ -104,7 +109,7 @@ npm exec -- skill-family-kit scaffold host-build --root <workspace> --host <id>
 npm exec -- skill-family-kit adopt-plan host-plan --root <workspace> --host <id> --path-category <id> --build-manifest <relpath> --probe-facts <relpath> --hosts-root <dir>
 ```
 
-The Profile must be provided explicitly; Kit does not bind a specific host by default. Probe starts no process by default; only when both `--allow-host-spawn --host-executable <absolute-path>` are given is the frozen version vector executed. `host-apply` is stably rejected; install, update, or uninstall is not implemented. Codex's skill target path is fixed at `.agents/skills`; other supported hosts are offered only per registered Profile; Qoder is `unsupported`, this version only references its structure, provides no full driver, and does not claim to have run in Qoder. adapter source only accepts declared text closures; binary projection is not supported; see this version's CHANGELOG and registered Profile for the precise host support matrix.
+The Profile must be provided explicitly; Kit does not bind a specific host by default. Canonical host IDs may resolve only aliases declared by the finite registered Profile set. Probe starts no process by default; only when both `--allow-host-spawn --host-executable <absolute-path>` are given is the frozen version vector executed. Local install and update use an explicit authorization reference plus the existing contained publication primitives; uninstall is rejected with `manual-recovery-required` because Foundation has no safe bound deletion primitive. Two registered hosts have trusted version drivers; Kimi Code, WorkBuddy, CodeBuddy, and DeepSeek Harness expose independent manual facts; Qoder is `unsupported`. Adapter source only accepts declared text closures; binary projection is not supported; see the [host capability matrix](../../docs/reference/host-capability-matrix.md) and registered Profiles.
 
 ## Typical Use Cases
 
@@ -166,7 +171,7 @@ This package must not perform git init, commit, push, tag, stash, branch switch,
 ### Do not use when
 
 - You need auto-fix (`check` does not fix), or auto-migration (`adopt-plan` writes no files).
-- You need host apply/install/update/uninstall or a full Qoder driver (explicitly unsupported).
+- You need remote host publication, automatic trust confirmation, uninstall deletion, or a full Qoder driver (explicitly unsupported).
 - You need a stable Quickstart API or expect the candidate helper to bypass `runProjection` authorization.
 
 ### Capability selection
@@ -177,7 +182,8 @@ This package must not perform git init, commit, push, tag, stash, branch switch,
 - `foundation.kit.check`: nine check classes, diagnosis only, no fix.
 - `foundation.kit.report`: projection/check report sub-action orchestration.
 - `foundation.kit.git-probe`: read-only whitelisted Git status probe.
-- `foundation.kit.host`: describe/build/probe/plan, apply stably rejected.
+- `foundation.kit.host`: describe/build/probe/plan plus authorized, digest-bound local install/update through `applyHostPlan`; Kit CLI apply, generic or remote apply, and deleting uninstall remain rejected.
+- `verifyHostPeers` is a thin read-only host entry over Harness peer adapter verification; it does not write peer directories or add a fifth command.
 - `foundation.kit.licensing`: Profile authorization-data loading and generation.
 - `foundation.kit.identity-check`: identity-drift and Profile-consistency checks.
 - `foundation.kit.cli`: four-command dispatch and mutation-flag entry rejection.
@@ -212,12 +218,12 @@ This package must not perform git init, commit, push, tag, stash, branch switch,
 ### Route elsewhere when
 
 - Remote publish: route to release-skill.
-- host apply/install/update/uninstall: explicitly unsupported.
+- remote host publication, automatic trust confirmation, and uninstall deletion: explicitly unsupported; local install/update are limited to the registered plan API.
 - Business state machine / migration execution: stays with the caller or a later version.
 
 ### Machine-readable sources
 
 - Public capability catalog: [`capability-catalog.json`](https://ifoohoo.github.io/skill-family-engineering-kit/agents/capability-catalog.json) (`foundation.kit.*` entries).
 - Package-local source: `src/*.mjs`.
-- Package-local candidate source: `candidate/*`; public import: `skill-family-engineering-kit/candidate/quickstart-profile`.
+- Package-local candidate source: `candidate/*`; canonical public imports: `skill-family-engineering-kit/quickstart-profile`, `/adoption`, and `/skill-naming`; historical migration alias: `skill-family-engineering-kit/candidate/quickstart-profile`.
 <!-- agent-quick-reference:end -->

package/README.zh-CN.md

@@ -5,24 +5,29 @@
 
 # skill-family-engineering-kit
 
-<!-- release-skill:release-version: 0.8.4 -->
+<!-- release-skill:release-version: 0.10.0 -->
 
 开发与 CI 阶段使用的工程工具包。**恰好四个**顶层命令，没有第五个：
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.8.4** (2026-08-24)
+**0.10.0** (2026-08-24)
 
-随 Foundation 0.8.4 锁步升版，补充外置 source authority 校验用法；Kit 命令与 Profile SPI 不变。
+Engineering Kit 0.10.0 为历史 candidate 提供职责明确的规范入口，增加受限的跨平台宿主身份、探针和本地生命周期能力，并提供同级适配器只读验证薄入口。
+
+**新增**
+
+- 新增 skill-family-engineering-kit/quickstart-profile、/adoption 与 /skill-naming 规范导出。
+- 增加有限 Profile alias 解析、非 driver 宿主的独立手动 probe fact 和显式本地 install/update 计划；uninstall 仍要求人工恢复。
+- 新增 `verifyHostPeers`，只包装 Harness 的 peer 验证，不增加第五个顶层命令，也不写入 peer 目录。
 
 **变更**
 
-- 包版本与 Contracts、Harness 一同升至 0.8.4。
-- 说明消费者先经 Contracts 校验 source-authority receipt，再把返回坐标传入既有 sourceRepository 与 sourceBaseCommit 字段。
-- 四个稳定顶层命令、builder、Profile SPI 与公共导出保持不变。
+- 历史 Quickstart candidate 导出继续作为同源迁移别名，Kit 四命令边界不变。
+- 只编译一套规范 Quickstart 与批量校验 Schema；历史和规范 ID 指向同一 standalone validator。
 
 **升级说明**
 
-消费者必须把三个 Foundation 包精确锁定到 0.8.4。provider Profile descriptor 从 0.8.3 与 Contracts 1.7.0 升级时，必须把自身的 base.contractsVersion 字段机械更新为 1.8.0。既有函数与 Schema 形状、Profile SPI v3、Kit 四命令均不需要迁移；需要 source authority 的消费者只增加调用 builder 前的 Contracts 校验步骤。
+消费者应把三个包的精确 pin 更新到 0.10.0，并把导入与 Schema ID 一次迁移到规范身份。以后仅晋升成熟度标签时不另加 Bundle 重建要求；包身份、来源摘要或 provenance 变化仍按既有投影合同处理。
 <!-- release-skill:managed:end id=latest-release -->
 
 | 命令 | 用途 | 副作用 |
@@ -43,7 +48,7 @@ Kit 是「工程阶段」层，依赖 Harness 与 Contracts。它只做四件事
 ## 安装和最小示例
 
 ```sh
-npm install --save-dev skill-family-engineering-kit@0.8.4
+npm install --save-dev skill-family-engineering-kit@0.10.0
 npm exec -- skill-family-kit --help
 npm exec -- skill-family-kit scaffold --root <empty-dir> --project-id my-project
 npm exec -- skill-family-kit adopt-plan --root <repo>
@@ -51,7 +56,7 @@ npm exec -- skill-family-kit projection --root <repo>
 npm exec -- skill-family-kit check --root <repo>
 ```
 
-以上四条命令分别覆盖生成骨架、只读盘点、受管投影与诊断；零安装形式可用 `npm exec --package=skill-family-engineering-kit@0.8.4 -- skill-family-kit --help`。
+以上四条命令分别覆盖生成骨架、只读盘点、受管投影与诊断；零安装形式可用 `npm exec --package=skill-family-engineering-kit@0.10.0 -- skill-family-kit --help`。
 
 ### 公共 Profile SPI
 
@@ -61,7 +66,7 @@ npm exec -- skill-family-kit check --root <repo>
 
 `verifyProfile({ profileRoot })` 只读处理 Profile descriptor；项目根声明使用对应的 `verifyProjectProfile({ projectRoot, profileRelPath? })`。两个入口遇到无效输入都以稳定结果码失败关闭，不会执行 Profile 提供的文件；Profile 的领域含义仍由调用方负责。
 
-provider Profile descriptor 从 Foundation 0.8.3 与 Contracts 1.7.0 升级到 Foundation 0.8.4 时，须把自身的 `base.contractsVersion` 字段机械更新为 `1.8.0`。既有函数与 Schema 形状、Profile SPI v3、Kit 四命令的形状均不变。
+provider Profile descriptor 从 Foundation 0.9.0 与 Contracts 1.9.0 升级到 Foundation 0.10.0 时，须把自身的 `base.contractsVersion` 字段更新为 `1.10.0`。Kit 四个顶层命令与 Profile SPI 的形状保持不变。
 
 ### 报告子动作
 
@@ -81,7 +86,7 @@ import { parseSourceAuthorityReceipt } from "skill-family-contracts";
 import {
   buildQuickstartProfileProjection,
   QUICKSTART_PROFILE_TARGET_PREFIX,
-} from "skill-family-engineering-kit/candidate/quickstart-profile";
+} from "skill-family-engineering-kit/quickstart-profile";
 
 const authority = parseSourceAuthorityReceipt(receipt, actualSubjects);
 if (!authority.valid) throw new Error(authority.errorCode);
@@ -94,7 +99,7 @@ const projection = await buildQuickstartProfileProjection({
 
 `receipt` 与 `actualSubjects` 由调用方在 Kit 外取得。Contracts 先精确核对两者，既有 builder 再接收返回的 `sourceRepository` 与 `sourceBaseCommit`；Kit 不解析发布计划，也不发现来源权威。生成的 Bundle 按 Schema `$id` 选择 standalone validator，离线运行时不依赖 Foundation 包、`node_modules` 或 Ajv。provenance 绑定 Foundation 来源、消费者 Schema、payload 字节、工具版本，以及实际进入 Bundle 的代码许可证。
 
-以上辅助函数不写文件，也不增加第五个顶层命令。调用方需要把返回的 `manifest` 交给稳定的 `runProjection` API。该子路径公开但**不稳定**；使用 v2 时应精确锁定 `0.4.0`，仍依赖 v1 依赖闭包 Bundle 的接入必须继续精确锁定 `0.2.1`。
+以上辅助函数不写文件，也不增加第五个顶层命令。调用方需要把返回的 `manifest` 交给稳定的 `runProjection` API。该能力仍是 **candidate**，必须精确锁定三个包。0.10.0 新增上面的规范入口；历史 `/candidate/quickstart-profile` 入口作为同源迁移别名继续可用。adoption 与 skill naming 也分别提供 `skill-family-engineering-kit/adoption` 和 `skill-family-engineering-kit/skill-naming` 规范入口。消费者迁移一次后，未来晋升 stable 不再二次迁移。仍依赖 v1 依赖闭包 Bundle 的接入必须继续精确锁定 `0.2.1`。
 
 ### 宿主子动作
 
@@ -105,7 +110,7 @@ npm exec -- skill-family-kit scaffold host-build --root <workspace> --host <id>
 npm exec -- skill-family-kit adopt-plan host-plan --root <workspace> --host <id> --path-category <id> --build-manifest <relpath> --probe-facts <relpath> --hosts-root <dir>
 ```
 
-Profile 必须显式提供，Kit 不默认绑定具体宿主。probe 默认不启动进程；只有同时给出 `--allow-host-spawn --host-executable <绝对路径>` 才执行冻结版本向量。`host-apply` 稳定拒绝，未实现安装、更新或卸载。Codex 的技能目标路径固定为 `.agents/skills`；其他受支持宿主只按已登记 Profile 提供；Qoder 为 `unsupported`，本版只参考其结构，不提供完整 driver，也不声称已在 Qoder 运行。adapter source 只接受已声明的文本闭包，不支持二进制投影；精确宿主支持矩阵见本版本 CHANGELOG 与已登记 Profile。
+Profile 必须显式提供，Kit 不默认绑定具体宿主。规范宿主 ID 只能解析已登记有限 Profile 中声明的 alias。probe 默认不启动进程；只有同时给出 `--allow-host-spawn --host-executable <绝对路径>` 才执行冻结版本向量。本地 install/update 通过显式授权引用和既有受收容发布原语执行；uninstall 因没有安全的绑定删除原语而返回 `manual-recovery-required`，不删除文件。Claude/Codex 使用受信版本 driver；Kimi Code、WorkBuddy、CodeBuddy 和 DeepSeek Harness 只提供独立手动事实；Qoder 为 `unsupported`。adapter source 只接受已声明的文本闭包，不支持二进制投影；精确宿主支持矩阵见 [宿主能力矩阵](../../docs/reference/host-capability-matrix.md) 与已登记 Profile。
 
 ## 典型使用场景
 
@@ -167,7 +172,7 @@ projection 只写同时满足两个条件的路径：manifest 列出，且目标
 ### Do not use when
 
 - 需要自动修复（`check` 不修复）、自动迁移（`adopt-plan` 不写文件）。
-- 需要 host apply/install/update/uninstall 或 Qoder 完整 driver（明确 unsupported）。
+- 需要远端宿主发布、自动信任、删除式 uninstall 或 Qoder 完整 driver（明确 unsupported）。
 - 需要稳定 Quickstart API，或希望 candidate 辅助函数绕过 `runProjection` 授权。
 
 ### Capability selection
@@ -178,7 +183,8 @@ projection 只写同时满足两个条件的路径：manifest 列出，且目标
 - `foundation.kit.check`：九类检查只诊断不修复。
 - `foundation.kit.report`：projection/check report 子动作编排。
 - `foundation.kit.git-probe`：只读白名单 Git 状态探测。
-- `foundation.kit.host`：describe/build/probe/plan，apply 稳定拒绝。
+- `foundation.kit.host`：有限身份解析、describe/build/probe/plan，以及受授权的本地 install/update；删除式 uninstall 和远端 apply 稳定拒绝。
+- `verifyHostPeers` 是 Harness 同级适配器验证的薄只读宿主入口，不写入 peer 目录，也不增加第五个顶层命令。
 - `foundation.kit.licensing`：Profile 授权数据加载与生成。
 - `foundation.kit.identity-check`：身份漂移与 Profile 一致性检查。
 - `foundation.kit.cli`：四命令分派与变更旗标入口拒绝。
@@ -213,12 +219,12 @@ projection 只写同时满足两个条件的路径：manifest 列出，且目标
 ### Route elsewhere when
 
 - 远端发布：转 release-skill。
-- host apply/install/update/uninstall：明确 unsupported。
+- 远端 host apply、自动信任与删除式 uninstall：明确 unsupported；本地 install/update 仅限已登记计划。
 - 业务状态机/迁移执行：留在调用方或后续版本。
 
 ### Machine-readable sources
 
 - 公开能力目录：[`capability-catalog.json`](https://ifoohoo.github.io/skill-family-engineering-kit/agents/capability-catalog.json)（`foundation.kit.*` 条目）。
 - 包内源：`src/*.mjs`。
-- 包内 Candidate 源：`candidate/*`；公共导入：`skill-family-engineering-kit/candidate/quickstart-profile`。
+- 包内 Candidate 源：`candidate/*`；规范公共导入：`skill-family-engineering-kit/quickstart-profile`、`/adoption` 与 `/skill-naming`；历史迁移别名：`skill-family-engineering-kit/candidate/quickstart-profile`。
 <!-- agent-quick-reference:end -->

package/candidate/adoption-mechanisms.mjs

@@ -7,7 +7,7 @@ import {
 import {
   verifyHarnessSurfaceInventory,
   verifyManagedBundleIdentity,
-} from "skill-family-harness-node/candidate/quickstart-profile";
+} from "skill-family-harness-node/quickstart-profile";
 
 export { verifyManagedBundleIdentity };