skill-family-engineering-kit 0.9.0 → 0.11.0

package/CHANGELOG.md

@@ -1,5 +1,48 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.11.0 locale=en baseline=sha256:108e261312b0838af53184710453fe19f369a9ea10ac5d1fc3e829e919d0f99d -->
+## [0.11.0] - 2026-08-25
+
+Engineering Kit 0.11.0 adds a candidate real-host verification API and ships the registered host Profile closure.
+
+### Added
+
+- Adds runHostVerification for one fresh, bounded Kimi or WorkBuddy invocation reusing the caller's existing login state, and verifyHostVerificationBindings for pure result composition.
+- Recomputes closure and stream digests from raw bytes and keeps private evidence outside the public result.
+- Ships the registered host Profile closure through bundledHostProfilesRoot().
+
+### Changed
+
+- Manual Profiles retain their lifecycle restrictions; host verification does not grant build, plan, apply, install, update, uninstall, or rollback support.
+
+### Upgrade Notes
+
+The 0.11.0 host-verification API is candidate-only. It does not own domain PASS/FAIL, release state, or automatic login, and it claims no authentication isolation, unchanged credentials, fixed model identity, or disabled host tool capability. executableSha256 is a point-in-time preflight observation, not proof of the executed image; the caller exclusively controls that namespace. Foundation retains session directories, and the caller cleans its outer temporaryRoot after inspection.
+<!-- release-skill:changelog:end version=0.11.0 locale=en -->
+
+
+<!-- release-skill:changelog:start version=0.10.0 locale=en baseline=sha256:fc575df3b8c5f7a0d819090ce9637f8cdc654c277892fe3f14149d5cc1746b24 -->
+## [0.10.0] - 2026-08-24
+
+Engineering Kit 0.10.0 adds responsibility-specific canonical entrypoints, a bounded host lifecycle slice, and a thin read-only peer adapter verification entry.
+
+### Added
+
+- Adds skill-family-engineering-kit/quickstart-profile, /adoption, and /skill-naming canonical exports.
+- Adds finite Profile alias resolution, independent manual probe facts for non-driver hosts, and explicit local install/update plans; uninstall remains a manual-recovery refusal.
+- Adds `verifyHostPeers` as a thin wrapper over Harness peer verification; the Kit retains four top-level commands and does not write peer directories.
+
+### Changed
+
+- Keeps the historical Quickstart candidate export as a same-source migration alias and preserves the four-command Kit boundary.
+- Compiles one canonical Quickstart and batch Schema set while mapping historical and canonical IDs to the same standalone validators.
+
+### Upgrade Notes
+
+Update all three exact pins to 0.10.0 and migrate imports and Schema IDs once to canonical identities. A later maturity-label promotion adds no separate Bundle rebuild requirement; package-identity, source-digest, and provenance changes continue to follow the existing projection contract.
+<!-- release-skill:changelog:end version=0.10.0 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.9.0 locale=en baseline=sha256:6419bbdc8d469e6dd7f9fda5995e5465cc6bf98724371f9f4aa9293a7e0d9f14 -->
 ## [0.9.0] - 2026-08-24
 

package/CHANGELOG.zh-CN.md

@@ -1,5 +1,48 @@
 # 变更日志
 
+<!-- release-skill:changelog:start version=0.11.0 locale=zh-CN baseline=sha256:5d5852f3fa3c970b4d277600a0886d533e3c883fc72ce144a85a071d1e270771 -->
+## [0.11.0] - 2026-08-25
+
+Engineering Kit 0.11.0 增加候选真实宿主验证 API，并随包携带已登记宿主 Profile 闭包。
+
+### 新增
+
+- 新增 runHostVerification，执行一次 fresh、受约束的 Kimi 或 WorkBuddy 调用（复用调用方现有登录态）；新增 verifyHostVerificationBindings，组合结果时只做纯校验。
+- 从原始字节重算闭包和流摘要，并把私有证据留在公共结果之外。
+- 通过 bundledHostProfilesRoot() 携带已登记宿主 Profile 闭包。
+
+### 变更
+
+- manual Profile 继续保留生命周期限制；宿主验证不会授予 build、plan、apply、install、update、uninstall 或 rollback 能力。
+
+### 升级说明
+
+0.11.0 宿主验证 API 仍为候选能力，不拥有领域 PASS/FAIL、发布状态或自动登录；不宣称认证状态隔离、凭证未变化、模型身份固定或宿主工具能力已关闭。executableSha256 只是启动前的点时观察，不证明实际执行映像；调用方独占对应命名空间。Foundation 保留 session 目录，调用方检查后清理外层 temporaryRoot。
+<!-- release-skill:changelog:end version=0.11.0 locale=zh-CN -->
+
+
+<!-- release-skill:changelog:start version=0.10.0 locale=zh-CN baseline=sha256:45180b7a3b60853842cbe3a379da7ff95f1bd1fe832192368ec2c92a813279dc -->
+## [0.10.0] - 2026-08-24
+
+Engineering Kit 0.10.0 为历史 candidate 提供职责明确的规范入口，增加受限的跨平台宿主身份、探针和本地生命周期能力，并提供同级适配器只读验证薄入口。
+
+### 新增
+
+- 新增 skill-family-engineering-kit/quickstart-profile、/adoption 与 /skill-naming 规范导出。
+- 增加有限 Profile alias 解析、非 driver 宿主的独立手动 probe fact 和显式本地 install/update 计划；uninstall 仍要求人工恢复。
+- 新增 `verifyHostPeers`，只包装 Harness 的 peer 验证，不增加第五个顶层命令，也不写入 peer 目录。
+
+### 变更
+
+- 历史 Quickstart candidate 导出继续作为同源迁移别名，Kit 四命令边界不变。
+- 只编译一套规范 Quickstart 与批量校验 Schema；历史和规范 ID 指向同一 standalone validator。
+
+### 升级说明
+
+消费者应把三个包的精确 pin 更新到 0.10.0，并把导入与 Schema ID 一次迁移到规范身份。以后仅晋升成熟度标签时不另加 Bundle 重建要求；包身份、来源摘要或 provenance 变化仍按既有投影合同处理。
+<!-- release-skill:changelog:end version=0.10.0 locale=zh-CN -->
+
+
 <!-- release-skill:changelog:start version=0.9.0 locale=zh-CN baseline=sha256:c84db7b53f562cbdad947ccf8fcc23209f18137100270b2691bab7d9a7ad623c -->
 ## [0.9.0] - 2026-08-24
 

package/README.md

@@ -4,27 +4,28 @@
 
 # skill-family-engineering-kit
 
-<!-- release-skill:release-version: 0.9.0 -->
+<!-- release-skill:release-version: 0.11.0 -->
 
 An engineering toolkit used in development and CI. There are **exactly four** top-level commands, and no fifth:
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.9.0** (2026-08-24)
+**0.11.0** (2026-08-25)
 
-Engineering Kit 0.9.0 projects the stable filesystem schemas, bound-read Harness closure, and candidate ordered batch validation into the existing Quickstart Bundle.
+Engineering Kit 0.11.0 adds a candidate real-host verification API and ships the registered host Profile closure.
 
 **Added**
 
-- Projects the three stable filesystem schemas and two candidate batch schemas from Contracts authorities.
-- Projects the stable bound-read entry and its exact native prebuild closure without adding a Kit command.
+- Adds runHostVerification for one fresh, bounded Kimi or WorkBuddy invocation reusing the caller's existing login state, and verifyHostVerificationBindings for pure result composition.
+- Recomputes closure and stream digests from raw bytes and keeps private evidence outside the public result.
+- Ships the registered host Profile closure through bundledHostProfilesRoot().
 
 **Changed**
 
-- Keeps the four top-level Kit commands and Profile SPI candidate boundary unchanged.
+- Manual Profiles retain their lifecycle restrictions; host verification does not grant build, plan, apply, install, update, uninstall, or rollback support.
 
 **Upgrade Notes**
 
-Pin all three Foundation packages to exactly 0.9.0 and rebuild managed Bundles. Batch validation is available only through the existing candidate Bundle and mechanisms CLI.
+The 0.11.0 host-verification API is candidate-only. It does not own domain PASS/FAIL, release state, or automatic login, and it claims no authentication isolation, unchanged credentials, fixed model identity, or disabled host tool capability. executableSha256 is a point-in-time preflight observation, not proof of the executed image; the caller exclusively controls that namespace. Foundation retains session directories, and the caller cleans its outer temporaryRoot after inspection.
 <!-- release-skill:managed:end id=latest-release -->
 
 | Command | Purpose | Side effects |
@@ -45,7 +46,7 @@ Kit is the "engineering stage" layer, depending on the Harness and Contracts. It
 ## Installation and Minimal Example
 
 ```sh
-npm install --save-dev skill-family-engineering-kit@0.9.0
+npm install --save-dev skill-family-engineering-kit@0.11.0
 npm exec -- skill-family-kit --help
 npm exec -- skill-family-kit scaffold --root <empty-dir> --project-id my-project
 npm exec -- skill-family-kit adopt-plan --root <repo>
@@ -53,7 +54,7 @@ npm exec -- skill-family-kit projection --root <repo>
 npm exec -- skill-family-kit check --root <repo>
 ```
 
-The four commands above cover skeleton generation, read-only inventory, managed projection, and diagnostics respectively; a zero-install form is available via `npm exec --package=skill-family-engineering-kit@0.9.0 -- skill-family-kit --help`.
+The four commands above cover skeleton generation, read-only inventory, managed projection, and diagnostics respectively; a zero-install form is available via `npm exec --package=skill-family-engineering-kit@0.11.0 -- skill-family-kit --help`.
 
 ### Public Profile SPI
 
@@ -63,7 +64,7 @@ The package carries three SPI JSON resources and the Contracts canonical `profil
 
 `verifyProfile({ profileRoot })` is read-only and data-only for Profile descriptors. `verifyProjectProfile({ projectRoot, profileRelPath? })` is the corresponding entry for a project root declaration. Both refuse invalid input with stable result codes, never execute Profile-provided files, and leave Profile domain meaning to the caller.
 
-When a provider Profile descriptor moves from Foundation 0.8.4 and Contracts 1.8.0 to Foundation 0.9.0, update its `base.contractsVersion` field mechanically to `1.9.0`. The four Kit commands and Profile SPI retain their existing shapes.
+When a provider Profile descriptor moves from Foundation 0.9.0 and Contracts 1.9.0 to Foundation 0.10.0, update its `base.contractsVersion` field mechanically to `1.10.0`. The four Kit commands and Profile SPI retain their existing shapes.
 
 ### Report sub-action
 
@@ -83,7 +84,7 @@ import { parseSourceAuthorityReceipt } from "skill-family-contracts";
 import {
   buildQuickstartProfileProjection,
   QUICKSTART_PROFILE_TARGET_PREFIX,
-} from "skill-family-engineering-kit/candidate/quickstart-profile";
+} from "skill-family-engineering-kit/quickstart-profile";
 
 const authority = parseSourceAuthorityReceipt(receipt, actualSubjects);
 if (!authority.valid) throw new Error(authority.errorCode);
@@ -96,7 +97,7 @@ const projection = await buildQuickstartProfileProjection({
 
 The caller obtains `receipt` and `actualSubjects` outside Kit. Contracts validates their exact binding before the existing builder receives `sourceRepository` and `sourceBaseCommit`; Kit does not parse release plans or discover source authority. The generated Bundle selects standalone validators by schema `$id` and runs offline without Foundation packages, `node_modules`, or runtime Ajv. Its provenance binds Foundation sources, consumer schemas, payload bytes, tool versions, and the licenses of code that actually enters the Bundle.
 
-Pass the returned `manifest` to the stable `runProjection` API; the helper does not write files or add a fifth top-level command. This subpath is public but **not stable**. Pin exactly `0.4.0` for v2; integrations that still require the v1 dependency-closure Bundle must stay pinned to exactly `0.2.1`.
+Pass the returned `manifest` to the stable `runProjection` API; the helper does not write files or add a fifth top-level command. The capability remains **candidate**, so pin all three packages exactly. Version 0.10.0 adds the canonical path above; the historical `/candidate/quickstart-profile` path remains a same-source migration alias. Adoption and skill naming now also have the canonical `skill-family-engineering-kit/adoption` and `skill-family-engineering-kit/skill-naming` paths. A later stable promotion will not require a second migration. Integrations that still require the v1 dependency-closure Bundle must stay pinned to exactly `0.2.1`.
 
 ### Host sub-action
 
@@ -107,7 +108,15 @@ npm exec -- skill-family-kit scaffold host-build --root <workspace> --host <id>
 npm exec -- skill-family-kit adopt-plan host-plan --root <workspace> --host <id> --path-category <id> --build-manifest <relpath> --probe-facts <relpath> --hosts-root <dir>
 ```
 
-The Profile must be provided explicitly; Kit does not bind a specific host by default. Probe starts no process by default; only when both `--allow-host-spawn --host-executable <absolute-path>` are given is the frozen version vector executed. `host-apply` is stably rejected; install, update, or uninstall is not implemented. Codex's skill target path is fixed at `.agents/skills`; other supported hosts are offered only per registered Profile; Qoder is `unsupported`, this version only references its structure, provides no full driver, and does not claim to have run in Qoder. adapter source only accepts declared text closures; binary projection is not supported; see this version's CHANGELOG and registered Profile for the precise host support matrix.
+The Profile must be provided explicitly; Kit does not bind a specific host by default. Canonical host IDs may resolve only aliases declared by the finite registered Profile set. Probe starts no process by default; only when both `--allow-host-spawn --host-executable <absolute-path>` are given is the frozen version vector executed. Local install and update use an explicit authorization reference plus the existing contained publication primitives; uninstall is rejected with `manual-recovery-required` because Foundation has no safe bound deletion primitive. Two registered hosts have trusted version drivers; Kimi Code, WorkBuddy, CodeBuddy, and DeepSeek Harness expose independent manual facts; Qoder is `unsupported`. Adapter source only accepts declared text closures; binary projection is not supported; see the [host capability matrix](../../docs/reference/host-capability-matrix.md) and registered Profiles.
+
+### Candidate real-host verification library API
+
+`runHostVerification({ request, bindings, hostsRoot })` and `verifyHostVerificationBindings({ results, expectedCommon, expectedRequestDigestByHost })` are library APIs, not a fifth Kit command. The first runs one bounded candidate verification against caller-bound roots using an admitted built-in driver (`kimi-code-print-v1` or `workbuddy-codebuddy-print-v1`, both bound to `existing-user-state + host-managed`) and returns a Contracts-validated, redacted four-state result. The second is pure and combines only `observed` results with the exact common fields and per-host request digest expected by the caller.
+
+The API keeps consumer workload, domain output checks, domain PASS/FAIL, release freshness, and release state outside Foundation. The caller supplies a canonical `existingUserStateRoot` that is projected into the child environment but never read, digested, modified or cleaned by Foundation; it does not grant manual Profiles any build, plan, apply, install, update, or uninstall capability. The Kimi and WorkBuddy real-host publication gates remain a hard publication requirement for 0.11.0.
+
+`executableSha256` binds only the bytes observed by the strict preflight read; the actual process is still spawned by pathname, so the caller must exclusively control the executable namespace through probe and invocation. Foundation retains the call's `session-*` directory and never deletes it by pathname. After inspection, the caller cleans its exclusively owned outer `temporaryRoot`.
 
 ## Typical Use Cases
 
@@ -169,7 +178,7 @@ This package must not perform git init, commit, push, tag, stash, branch switch,
 ### Do not use when
 
 - You need auto-fix (`check` does not fix), or auto-migration (`adopt-plan` writes no files).
-- You need host apply/install/update/uninstall or a full Qoder driver (explicitly unsupported).
+- You need remote host publication, automatic trust confirmation, uninstall deletion, or a full Qoder driver (explicitly unsupported).
 - You need a stable Quickstart API or expect the candidate helper to bypass `runProjection` authorization.
 
 ### Capability selection
@@ -180,7 +189,8 @@ This package must not perform git init, commit, push, tag, stash, branch switch,
 - `foundation.kit.check`: nine check classes, diagnosis only, no fix.
 - `foundation.kit.report`: projection/check report sub-action orchestration.
 - `foundation.kit.git-probe`: read-only whitelisted Git status probe.
-- `foundation.kit.host`: describe/build/probe/plan, apply stably rejected.
+- `foundation.kit.host`: describe/build/probe/plan plus authorized, digest-bound local install/update through `applyHostPlan`; Kit CLI apply, generic or remote apply, and deleting uninstall remain rejected.
+- `verifyHostPeers` is a thin read-only host entry over Harness peer adapter verification; it does not write peer directories or add a fifth command.
 - `foundation.kit.licensing`: Profile authorization-data loading and generation.
 - `foundation.kit.identity-check`: identity-drift and Profile-consistency checks.
 - `foundation.kit.cli`: four-command dispatch and mutation-flag entry rejection.
@@ -215,12 +225,12 @@ This package must not perform git init, commit, push, tag, stash, branch switch,
 ### Route elsewhere when
 
 - Remote publish: route to release-skill.
-- host apply/install/update/uninstall: explicitly unsupported.
+- remote host publication, automatic trust confirmation, and uninstall deletion: explicitly unsupported; local install/update are limited to the registered plan API.
 - Business state machine / migration execution: stays with the caller or a later version.
 
 ### Machine-readable sources
 
 - Public capability catalog: [`capability-catalog.json`](https://ifoohoo.github.io/skill-family-engineering-kit/agents/capability-catalog.json) (`foundation.kit.*` entries).
 - Package-local source: `src/*.mjs`.
-- Package-local candidate source: `candidate/*`; public import: `skill-family-engineering-kit/candidate/quickstart-profile`.
+- Package-local candidate source: `candidate/*`; canonical public imports: `skill-family-engineering-kit/quickstart-profile`, `/adoption`, and `/skill-naming`; historical migration alias: `skill-family-engineering-kit/candidate/quickstart-profile`.
 <!-- agent-quick-reference:end -->

package/README.zh-CN.md

@@ -5,27 +5,28 @@
 
 # skill-family-engineering-kit
 
-<!-- release-skill:release-version: 0.9.0 -->
+<!-- release-skill:release-version: 0.11.0 -->
 
 开发与 CI 阶段使用的工程工具包。**恰好四个**顶层命令，没有第五个：
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.9.0** (2026-08-24)
+**0.11.0** (2026-08-25)
 
-Engineering Kit 0.9.0 将稳定文件系统 Schema、绑定读取 Harness 闭包与有序批量校验 candidate 投影到既有 Quickstart Bundle。
+Engineering Kit 0.11.0 增加候选真实宿主验证 API，并随包携带已登记宿主 Profile 闭包。
 
 **新增**
 
-- 从 Contracts 权威源投影三个稳定文件系统 Schema 与两个批量校验 candidate Schema。
-- 投影稳定绑定读取入口及其精确原生预构建闭包，不新增 Kit 命令。
+- 新增 runHostVerification，执行一次 fresh、受约束的 Kimi 或 WorkBuddy 调用（复用调用方现有登录态）；新增 verifyHostVerificationBindings，组合结果时只做纯校验。
+- 从原始字节重算闭包和流摘要，并把私有证据留在公共结果之外。
+- 通过 bundledHostProfilesRoot() 携带已登记宿主 Profile 闭包。
 
 **变更**
 
-- 四个顶层 Kit 命令与 Profile SPI 的 candidate 边界保持不变。
+- manual Profile 继续保留生命周期限制；宿主验证不会授予 build、plan、apply、install、update、uninstall 或 rollback 能力。
 
 **升级说明**
 
-三个 Foundation 包必须精确锁定 0.9.0 并重新构建 managed Bundle；批量校验只能通过既有 candidate Bundle 与 mechanisms CLI 使用。
+0.11.0 宿主验证 API 仍为候选能力，不拥有领域 PASS/FAIL、发布状态或自动登录；不宣称认证状态隔离、凭证未变化、模型身份固定或宿主工具能力已关闭。executableSha256 只是启动前的点时观察，不证明实际执行映像；调用方独占对应命名空间。Foundation 保留 session 目录，调用方检查后清理外层 temporaryRoot。
 <!-- release-skill:managed:end id=latest-release -->
 
 | 命令 | 用途 | 副作用 |
@@ -46,7 +47,7 @@ Kit 是「工程阶段」层，依赖 Harness 与 Contracts。它只做四件事
 ## 安装和最小示例
 
 ```sh
-npm install --save-dev skill-family-engineering-kit@0.9.0
+npm install --save-dev skill-family-engineering-kit@0.11.0
 npm exec -- skill-family-kit --help
 npm exec -- skill-family-kit scaffold --root <empty-dir> --project-id my-project
 npm exec -- skill-family-kit adopt-plan --root <repo>
@@ -54,7 +55,7 @@ npm exec -- skill-family-kit projection --root <repo>
 npm exec -- skill-family-kit check --root <repo>
 ```
 
-以上四条命令分别覆盖生成骨架、只读盘点、受管投影与诊断；零安装形式可用 `npm exec --package=skill-family-engineering-kit@0.9.0 -- skill-family-kit --help`。
+以上四条命令分别覆盖生成骨架、只读盘点、受管投影与诊断；零安装形式可用 `npm exec --package=skill-family-engineering-kit@0.11.0 -- skill-family-kit --help`。
 
 ### 公共 Profile SPI
 
@@ -64,7 +65,7 @@ npm exec -- skill-family-kit check --root <repo>
 
 `verifyProfile({ profileRoot })` 只读处理 Profile descriptor；项目根声明使用对应的 `verifyProjectProfile({ projectRoot, profileRelPath? })`。两个入口遇到无效输入都以稳定结果码失败关闭，不会执行 Profile 提供的文件；Profile 的领域含义仍由调用方负责。
 
-provider Profile descriptor 从 Foundation 0.8.4 与 Contracts 1.8.0 升级到 Foundation 0.9.0 时，须把自身的 `base.contractsVersion` 字段更新为 `1.9.0`。Kit 四个顶层命令与 Profile SPI 的形状保持不变。
+provider Profile descriptor 从 Foundation 0.9.0 与 Contracts 1.9.0 升级到 Foundation 0.10.0 时，须把自身的 `base.contractsVersion` 字段更新为 `1.10.0`。Kit 四个顶层命令与 Profile SPI 的形状保持不变。
 
 ### 报告子动作
 
@@ -84,7 +85,7 @@ import { parseSourceAuthorityReceipt } from "skill-family-contracts";
 import {
   buildQuickstartProfileProjection,
   QUICKSTART_PROFILE_TARGET_PREFIX,
-} from "skill-family-engineering-kit/candidate/quickstart-profile";
+} from "skill-family-engineering-kit/quickstart-profile";
 
 const authority = parseSourceAuthorityReceipt(receipt, actualSubjects);
 if (!authority.valid) throw new Error(authority.errorCode);
@@ -97,7 +98,7 @@ const projection = await buildQuickstartProfileProjection({
 
 `receipt` 与 `actualSubjects` 由调用方在 Kit 外取得。Contracts 先精确核对两者，既有 builder 再接收返回的 `sourceRepository` 与 `sourceBaseCommit`；Kit 不解析发布计划，也不发现来源权威。生成的 Bundle 按 Schema `$id` 选择 standalone validator，离线运行时不依赖 Foundation 包、`node_modules` 或 Ajv。provenance 绑定 Foundation 来源、消费者 Schema、payload 字节、工具版本，以及实际进入 Bundle 的代码许可证。
 
-以上辅助函数不写文件，也不增加第五个顶层命令。调用方需要把返回的 `manifest` 交给稳定的 `runProjection` API。该子路径公开但**不稳定**；使用 v2 时应精确锁定 `0.4.0`，仍依赖 v1 依赖闭包 Bundle 的接入必须继续精确锁定 `0.2.1`。
+以上辅助函数不写文件，也不增加第五个顶层命令。调用方需要把返回的 `manifest` 交给稳定的 `runProjection` API。该能力仍是 **candidate**，必须精确锁定三个包。0.10.0 新增上面的规范入口；历史 `/candidate/quickstart-profile` 入口作为同源迁移别名继续可用。adoption 与 skill naming 也分别提供 `skill-family-engineering-kit/adoption` 和 `skill-family-engineering-kit/skill-naming` 规范入口。消费者迁移一次后，未来晋升 stable 不再二次迁移。仍依赖 v1 依赖闭包 Bundle 的接入必须继续精确锁定 `0.2.1`。
 
 ### 宿主子动作
 
@@ -108,7 +109,15 @@ npm exec -- skill-family-kit scaffold host-build --root <workspace> --host <id>
 npm exec -- skill-family-kit adopt-plan host-plan --root <workspace> --host <id> --path-category <id> --build-manifest <relpath> --probe-facts <relpath> --hosts-root <dir>
 ```
 
-Profile 必须显式提供，Kit 不默认绑定具体宿主。probe 默认不启动进程；只有同时给出 `--allow-host-spawn --host-executable <绝对路径>` 才执行冻结版本向量。`host-apply` 稳定拒绝，未实现安装、更新或卸载。Codex 的技能目标路径固定为 `.agents/skills`；其他受支持宿主只按已登记 Profile 提供；Qoder 为 `unsupported`，本版只参考其结构，不提供完整 driver，也不声称已在 Qoder 运行。adapter source 只接受已声明的文本闭包，不支持二进制投影；精确宿主支持矩阵见本版本 CHANGELOG 与已登记 Profile。
+Profile 必须显式提供，Kit 不默认绑定具体宿主。规范宿主 ID 只能解析已登记有限 Profile 中声明的 alias。probe 默认不启动进程；只有同时给出 `--allow-host-spawn --host-executable <绝对路径>` 才执行冻结版本向量。本地 install/update 通过显式授权引用和既有受收容发布原语执行；uninstall 因没有安全的绑定删除原语而返回 `manual-recovery-required`，不删除文件。Claude/Codex 使用受信版本 driver；Kimi Code、WorkBuddy、CodeBuddy 和 DeepSeek Harness 只提供独立手动事实；Qoder 为 `unsupported`。adapter source 只接受已声明的文本闭包，不支持二进制投影；精确宿主支持矩阵见 [宿主能力矩阵](../../docs/reference/host-capability-matrix.md) 与已登记 Profile。
+
+### 候选真实宿主验证库 API
+
+`runHostVerification({ request, bindings, hostsRoot })` 和 `verifyHostVerificationBindings({ results, expectedCommon, expectedRequestDigestByHost })` 是库 API，不是第五个 Kit 命令。前者通过已准入的内置 driver（`kimi-code-print-v1` 或 `workbuddy-codebuddy-print-v1`，均绑定 `existing-user-state + host-managed`），针对调用方绑定的根执行一次候选验证，并返回经过 Contracts 校验的脱敏四态结果；后者是纯函数，只组合 `observed` 结果，并核对共同字段和逐宿主 request digest。
+
+该 API 不接管消费者 workload、领域输出检查、领域 PASS/FAIL、发布新鲜度或发布状态。调用方提供 canonical 的 `existingUserStateRoot`；Foundation 只把它投影进子进程环境，不读取、摘要、修改或清理其中内容，也不会因此为 manual Profile 授予 build、plan、apply、install、update 或 uninstall 能力。
+
+`executableSha256` 只绑定启动前严格读取到的字节。实际进程仍按 pathname 启动，因此调用方必须在 probe 和正式调用期间独占可执行文件的命名空间。Foundation 保留本次调用的 `session-*` 目录，不按路径删除；调用方检查完成后，统一清理其独占的外层 `temporaryRoot`。
 
 ## 典型使用场景
 
@@ -170,7 +179,7 @@ projection 只写同时满足两个条件的路径：manifest 列出，且目标
 ### Do not use when
 
 - 需要自动修复（`check` 不修复）、自动迁移（`adopt-plan` 不写文件）。
-- 需要 host apply/install/update/uninstall 或 Qoder 完整 driver（明确 unsupported）。
+- 需要远端宿主发布、自动信任、删除式 uninstall 或 Qoder 完整 driver（明确 unsupported）。
 - 需要稳定 Quickstart API，或希望 candidate 辅助函数绕过 `runProjection` 授权。
 
 ### Capability selection
@@ -181,7 +190,8 @@ projection 只写同时满足两个条件的路径：manifest 列出，且目标
 - `foundation.kit.check`：九类检查只诊断不修复。
 - `foundation.kit.report`：projection/check report 子动作编排。
 - `foundation.kit.git-probe`：只读白名单 Git 状态探测。
-- `foundation.kit.host`：describe/build/probe/plan，apply 稳定拒绝。
+- `foundation.kit.host`：有限身份解析、describe/build/probe/plan，以及受授权的本地 install/update；删除式 uninstall 和远端 apply 稳定拒绝。
+- `verifyHostPeers` 是 Harness 同级适配器验证的薄只读宿主入口，不写入 peer 目录，也不增加第五个顶层命令。
 - `foundation.kit.licensing`：Profile 授权数据加载与生成。
 - `foundation.kit.identity-check`：身份漂移与 Profile 一致性检查。
 - `foundation.kit.cli`：四命令分派与变更旗标入口拒绝。
@@ -216,12 +226,12 @@ projection 只写同时满足两个条件的路径：manifest 列出，且目标
 ### Route elsewhere when
 
 - 远端发布：转 release-skill。
-- host apply/install/update/uninstall：明确 unsupported。
+- 远端 host apply、自动信任与删除式 uninstall：明确 unsupported；本地 install/update 仅限已登记计划。
 - 业务状态机/迁移执行：留在调用方或后续版本。
 
 ### Machine-readable sources
 
 - 公开能力目录：[`capability-catalog.json`](https://ifoohoo.github.io/skill-family-engineering-kit/agents/capability-catalog.json)（`foundation.kit.*` 条目）。
 - 包内源：`src/*.mjs`。
-- 包内 Candidate 源：`candidate/*`；公共导入：`skill-family-engineering-kit/candidate/quickstart-profile`。
+- 包内 Candidate 源：`candidate/*`；规范公共导入：`skill-family-engineering-kit/quickstart-profile`、`/adoption` 与 `/skill-naming`；历史迁移别名：`skill-family-engineering-kit/candidate/quickstart-profile`。
 <!-- agent-quick-reference:end -->

package/candidate/adoption-mechanisms.mjs

@@ -7,7 +7,7 @@ import {
 import {
   verifyHarnessSurfaceInventory,
   verifyManagedBundleIdentity,
-} from "skill-family-harness-node/candidate/quickstart-profile";
+} from "skill-family-harness-node/quickstart-profile";
 
 export { verifyManagedBundleIdentity };
 

package/candidate/profile-bundle.mjs

@@ -7,11 +7,12 @@ import {
   canonicalJson,
 } from "skill-family-contracts";
 import {
+  HISTORICAL_CANDIDATE_SCHEMA_ID_MIGRATIONS,
   QUICKSTART_PROFILE_ID,
   QUICKSTART_PROFILE_VERSION,
-} from "skill-family-contracts/candidate/quickstart-profile";
+} from "skill-family-contracts/quickstart-profile";
 import { digestBytes } from "skill-family-harness-node";
-import { verifyConsumerSchemaInventory } from "skill-family-harness-node/candidate/quickstart-profile";
+import { verifyConsumerSchemaInventory } from "skill-family-harness-node/quickstart-profile";
 
 /**
  * Candidate Quickstart Profile v2 offline bundle builder (unstable).
@@ -79,7 +80,7 @@ const ADDITIONAL_FOUNDATION_SCHEMA_FILES = Object.freeze([
 
 const HARNESS_IMPORT_MAP = new Map([
   ["skill-family-contracts", "../contracts/index.mjs"],
-  ["skill-family-contracts/candidate/quickstart-profile", "../contracts-candidate/index.mjs"],
+  ["skill-family-contracts/quickstart-profile", "../contracts-candidate/index.mjs"],
   ["../src/closure.mjs", "./closure.mjs"],
   ["../src/errors.mjs", "./errors.mjs"],
   ["../src/paths.mjs", "./paths.mjs"],
@@ -110,7 +111,7 @@ const HARNESS_TOKEN_LOCK_IMPORT_MAP = new Map([
 
 const ADOPTION_IMPORT_MAP = new Map([
   ["../src/migration.mjs", "./runtime/kit/migration.mjs"],
-  ["skill-family-harness-node/candidate/quickstart-profile", "./runtime/harness/quickstart-profile.mjs"],
+  ["skill-family-harness-node/quickstart-profile", "./runtime/harness/quickstart-profile.mjs"],
 ]);
 
 const DIALECT_URIS = Object.freeze({
@@ -1043,6 +1044,32 @@ function standaloneMapSource({ entries2020, entriesDraft07 }) {
   return lines.join("\n");
 }
 
+function standaloneEntriesWithHistoricalAliases(schemaIds) {
+  const canonicalEntries = [...schemaIds]
+    .sort()
+    .map((schemaId, index) => ({ schemaId, exportName: standaloneExportName(index) }));
+  const canonicalById = new Map(
+    canonicalEntries.map((entry) => [entry.schemaId, entry]),
+  );
+  const aliases = Object.entries(HISTORICAL_CANDIDATE_SCHEMA_ID_MIGRATIONS)
+    .map(([legacyId, canonicalId]) => {
+      if (canonicalById.has(legacyId)) {
+        throw new Error(
+          `historical candidate schema $id collides with a canonical schema: ${legacyId}`,
+        );
+      }
+      const canonical = canonicalById.get(canonicalId);
+      if (!canonical) {
+        throw new Error(
+          `historical candidate schema migration target is absent from the Bundle: ${canonicalId}`,
+        );
+      }
+      return { schemaId: legacyId, exportName: canonical.exportName };
+    });
+  return [...canonicalEntries, ...aliases]
+    .sort((a, b) => (a.schemaId < b.schemaId ? -1 : a.schemaId > b.schemaId ? 1 : 0));
+}
+
 function validatorsSource() {
   return `import standaloneValidators from "./runtime/generated/standalone-map.mjs";
 import { findNonJsonValue, normalizeValidationError } from "./runtime/json-boundary.mjs";
@@ -1292,6 +1319,14 @@ export async function buildQuickstartProfileProjection({
 
   const graph = buildSchemaGraph(consumerRecords, foundationSchemaDocuments);
 
+  for (const record of consumerRecords) {
+    if (Object.hasOwn(HISTORICAL_CANDIDATE_SCHEMA_ID_MIGRATIONS, record.document.$id)) {
+      throw buildError(
+        `consumer schema $id is reserved for a historical Foundation identity: ${record.document.$id}`,
+      );
+    }
+  }
+
   // --- Standalone validator generation (Ajv build dependency only). ---
   const fromContracts = createRequire(pathToFileURL(path.join(contractsRoot, "package.json")));
   const ajvEntry = fromContracts.resolve("ajv");
@@ -1322,6 +1357,10 @@ export async function buildQuickstartProfileProjection({
     ...foundationSchemaDocuments.map((entry) => entry.document),
     ...graph["2020-12"].map((record) => record.document),
   ];
+  const generated2020SchemaIds = [
+    ...schemas2020.map((schema) => schema.$id),
+    "https://contracts.skill-family.example/quickstart-profile/v2/harness-surface-detectors.json",
+  ];
   const generated2020 = await generateStandaloneModule({
     AjvCtor: Ajv2020,
     schemas: schemas2020,
@@ -1329,10 +1368,7 @@ export async function buildQuickstartProfileProjection({
     codegenTemplate,
     standaloneCode,
     isValidDateTime,
-    schemaIds: [
-      ...schemas2020.map((schema) => schema.$id),
-      "https://contracts.skill-family.example/candidate/quickstart-profile/v2/harness-surface-detectors.json",
-    ],
+    schemaIds: generated2020SchemaIds,
   });
   const schemasDraft07 = graph["draft-07"].map((record) => record.document);
   const withDraft07 = schemasDraft07.length > 0;
@@ -1487,12 +1523,7 @@ export async function buildQuickstartProfileProjection({
     setText("runtime/generated/validate-draft-07.mjs", generatedDraft07);
   }
   const sortById = (a, b) => (a.$id < b.$id ? -1 : 1);
-  const entries2020 = [
-    ...schemas2020.map((schema) => schema.$id),
-    "https://contracts.skill-family.example/candidate/quickstart-profile/v2/harness-surface-detectors.json",
-  ]
-    .sort()
-    .map((schemaId, index) => ({ schemaId, exportName: standaloneExportName(index) }));
+  const entries2020 = standaloneEntriesWithHistoricalAliases(generated2020SchemaIds);
   const entriesDraft07 = [...schemasDraft07]
     .sort(sortById)
     .map((schema, index) => ({ schemaId: schema.$id, exportName: standaloneExportName(index) }));

package/data/hosts/claude/host-descriptor.json

@@ -0,0 +1,40 @@
+{
+  "schemaVersion": 1,
+  "kind": "skill-family.host-descriptor",
+  "hostId": "claude",
+  "displayName": "Claude Code",
+  "support": "supported",
+  "maturity": "stable",
+  "sourceAliases": [
+    "claude-code"
+  ],
+  "driverId": "claude-version-v1",
+  "adapterFormat": "skill-directory-v1",
+  "pathCategories": [
+    {
+      "id": "claude-user-skills",
+      "role": "skill-root",
+      "scope": "user",
+      "anchor": "user-home",
+      "relPath": ".claude/skills"
+    },
+    {
+      "id": "claude-project-skills",
+      "role": "skill-root",
+      "scope": "project",
+      "anchor": "project-root",
+      "relPath": ".claude/skills"
+    }
+  ],
+  "probeCapabilities": [
+    "cli",
+    "version",
+    "payload",
+    "registry",
+    "discover",
+    "enabled",
+    "reload",
+    "smoke",
+    "uninstall"
+  ]
+}

package/data/hosts/codebuddy/host-descriptor.json

@@ -0,0 +1,21 @@
+{
+  "schemaVersion": 1,
+  "kind": "skill-family.host-descriptor",
+  "hostId": "codebuddy",
+  "displayName": "CodeBuddy",
+  "support": "manual",
+  "maturity": "manual",
+  "sourceAliases": [],
+  "pathCategories": [],
+  "probeCapabilities": [
+    "cli",
+    "version",
+    "payload",
+    "registry",
+    "discover",
+    "enabled",
+    "reload",
+    "smoke",
+    "uninstall"
+  ]
+}

package/data/hosts/codex/host-descriptor.json

@@ -0,0 +1,40 @@
+{
+  "schemaVersion": 1,
+  "kind": "skill-family.host-descriptor",
+  "hostId": "codex",
+  "displayName": "Codex",
+  "support": "supported",
+  "maturity": "stable",
+  "sourceAliases": [
+    "openai-codex"
+  ],
+  "driverId": "codex-version-v1",
+  "adapterFormat": "skill-directory-v1",
+  "pathCategories": [
+    {
+      "id": "codex-user-skills",
+      "role": "skill-root",
+      "scope": "user",
+      "anchor": "user-home",
+      "relPath": ".agents/skills"
+    },
+    {
+      "id": "codex-project-skills",
+      "role": "skill-root",
+      "scope": "project",
+      "anchor": "project-root",
+      "relPath": ".agents/skills"
+    }
+  ],
+  "probeCapabilities": [
+    "cli",
+    "version",
+    "payload",
+    "registry",
+    "discover",
+    "enabled",
+    "reload",
+    "smoke",
+    "uninstall"
+  ]
+}

package/data/hosts/deepseek-harness/host-descriptor.json

@@ -0,0 +1,23 @@
+{
+  "schemaVersion": 1,
+  "kind": "skill-family.host-descriptor",
+  "hostId": "deepseek-harness",
+  "displayName": "DeepSeek Harness",
+  "support": "manual",
+  "maturity": "developer-preview",
+  "sourceAliases": [
+    "dsh"
+  ],
+  "pathCategories": [],
+  "probeCapabilities": [
+    "cli",
+    "version",
+    "payload",
+    "registry",
+    "discover",
+    "enabled",
+    "reload",
+    "smoke",
+    "uninstall"
+  ]
+}