skill-family-harness-node 0.10.0 → 0.12.0

package/CHANGELOG.md

@@ -1,5 +1,40 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.12.0 locale=en baseline=sha256:0074df3a947706f6cd6d8593968a348cd4d3f38d8f2bf75f15a04c8183d76618 -->
+## [0.12.0] - 2026-08-26
+
+Harness 0.12.0 joins the lockstep Foundation release with its existing process and filesystem mechanisms unchanged.
+
+### Changed
+
+- Pins skill-family-contracts to 0.12.0 for the five-host verification extension implemented by Engineering Kit.
+
+### Upgrade Notes
+
+No new Harness API or runtime behavior is introduced. Existing process supervision, raw-byte sinks, bound reads, and digest mechanisms remain the shared implementation; host-specific protocol rules belong to Engineering Kit.
+<!-- release-skill:changelog:end version=0.12.0 locale=en -->
+
+
+<!-- release-skill:changelog:start version=0.11.0 locale=en baseline=sha256:e20f505e42ba45865bfee38a6c83671006bf20148d5d4e421ff7f443bcce260b -->
+## [0.11.0] - 2026-08-25
+
+Harness 0.11.0 adds raw-byte subprocess sinks and exposes the bound-read root identity needed by host verification.
+
+### Added
+
+- Extends superviseProcess with an exclusive, no-follow raw stdout/stderr sink that waits for stream close, queued writes, fsync, and close.
+- Keeps the existing bound-read mechanism as the only root and member read authority.
+
+### Changed
+
+- Carries the previously prepared host Profile closure into the lockstep 0.11.0 family release.
+
+### Upgrade Notes
+
+The raw sink is mechanism-only; it does not create a second process runner, receipt state machine, or host-specific policy. The caller must exclusively control the sink namespace for the whole call; handle protection does not prove stable pathname or root identity.
+<!-- release-skill:changelog:end version=0.11.0 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.10.0 locale=en baseline=sha256:64a325d3e51604a8436b33df5a7f617f9aab1f1e02adb32ccb58316aa5c5eab1 -->
 ## [0.10.0] - 2026-08-24
 

package/CHANGELOG.zh-CN.md

@@ -1,5 +1,40 @@
 # 变更日志
 
+<!-- release-skill:changelog:start version=0.12.0 locale=zh-CN baseline=sha256:2e7db41a08c30d9e0bdc16b4cd27853104ef79dc02f7e9925a1383a6546f5111 -->
+## [0.12.0] - 2026-08-26
+
+Harness 0.12.0 随 Foundation 三包锁步升级，既有进程与文件系统机制保持不变。
+
+### 变更
+
+- 将 skill-family-contracts 精确依赖更新为 0.12.0，支持 Engineering Kit 的五平台验证扩展。
+
+### 升级说明
+
+本版本不新增 Harness API，也不改变运行行为。进程监督、原始字节输出、绑定读取和摘要继续复用既有机制；宿主专属的协议规则由 Engineering Kit 实现。
+<!-- release-skill:changelog:end version=0.12.0 locale=zh-CN -->
+
+
+<!-- release-skill:changelog:start version=0.11.0 locale=zh-CN baseline=sha256:51776685eead52118cc98ee47b8ac8990650a493d60567002133ff74e1c779c6 -->
+## [0.11.0] - 2026-08-25
+
+Harness 0.11.0 增加原始字节子进程输出 sink，并暴露真实宿主验证所需的受保护根身份。
+
+### 新增
+
+- 为 superviseProcess 增加独占、禁止跟随符号链接的 stdout/stderr 原始字节 sink，并等待流关闭、排队写入、fsync 与 close。
+- 继续把既有 bound-read 机制作为唯一根目录与成员读取权威。
+
+### 变更
+
+- 把此前准备好的宿主 Profile 闭包并入 0.11.0 三包锁步交付。
+
+### 升级说明
+
+原始 sink 只提供机制，不建立第二个进程 runner、收据状态机或宿主专属策略。调用方必须在整个调用期间独占 sink 命名空间；句柄保护不证明 pathname 或根目录身份始终不变。
+<!-- release-skill:changelog:end version=0.11.0 locale=zh-CN -->
+
+
 <!-- release-skill:changelog:start version=0.10.0 locale=zh-CN baseline=sha256:d8e27cce0c3e97b7d10b6f88fad4df66c8d527d3d6a2fb165f8c909612ff9f19 -->
 ## [0.10.0] - 2026-08-24
 

package/README.md

@@ -4,29 +4,22 @@
 
 # skill-family-harness-node
 
-<!-- release-skill:release-version: 0.10.0 -->
+<!-- release-skill:release-version: 0.12.0 -->
 
 The **single default Node implementation** of the Contracts mechanism protocol. This is a thin runtime: it only implements the mechanism protocol, introduces no business semantics, and does not provide a second-language implementation.
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.10.0** (2026-08-24)
+**0.12.0** (2026-08-26)
 
-Harness 0.10.0 adds canonical entrypoints, reuses existing host mechanisms, and adds read-only peer adapter verification from real directories.
-
-**Added**
-
-- Adds skill-family-harness-node/quickstart-profile and skill-family-harness-node/rename-directory-no-replace canonical exports.
-- Reuses filesystem-root binding, strict no-replace publication, atomic replacement, and existing build digests for the Kit's local host install/update path.
-- Adds `verifyPeerAdapterDirectories`, which re-enumerates peer roots and verifies common closure, byte digests, standard manifests, and complete logical mappings without writing them.
+Harness 0.12.0 joins the lockstep Foundation release with its existing process and filesystem mechanisms unchanged.
 
 **Changed**
 
-- Keeps each historical candidate export as a same-source migration alias and leaves the mechanism registry unchanged.
-- Keeps validate-many-by-schema-id and its error semantics unchanged while managed Bundles accept historical and canonical Schema IDs through the same validator.
+- Pins skill-family-contracts to 0.12.0 for the five-host verification extension implemented by Engineering Kit.
 
 **Upgrade Notes**
 
-Update all three exact pins to 0.10.0 and migrate historical candidate imports and Schema IDs once to canonical identities. The low-level no-replace primitive remains distinct from the stable fixed-set-publication API; choose the contract that matches the use case.
+No new Harness API or runtime behavior is introduced. Existing process supervision, raw-byte sinks, bound reads, and digest mechanisms remain the shared implementation; host-specific protocol rules belong to Engineering Kit.
 <!-- release-skill:managed:end id=latest-release -->
 
 ## Problem It Solves
@@ -35,19 +28,19 @@ Contracts defines "what should be", and the Harness turns that into "can be safe
 
 ## Core Mental Model
 
-The Harness consumes `skill-family-contracts` (a workspace dependency), reusing its dialect-routed Ajv validator, Kernel Protocol, frozen error codes, and fixtures; it does not copy protocol definitions or re-interpret the Schema. It only implements mechanisms: Schema validation, atomic writes, path containment, temporary workspaces, resource closure, the operation-request → operation-result pipeline, and business-neutral event logging with derived snapshots. Explicitly excluded: business semantics, task orchestration, Git writes, model calls, remote networking, and publish state. See `HARNESS_EXCLUSIONS`.
+The Harness consumes `skill-family-contracts` (a workspace dependency), reusing its dialect-routed Ajv validator, Kernel Protocol, frozen error codes, and fixtures; it does not copy protocol definitions or re-interpret the Schema. It only implements mechanisms: Schema validation, atomic writes, path containment, temporary workspaces, resource closure, bounded process supervision, the operation-request → operation-result pipeline, and business-neutral event logging with derived snapshots. Explicitly excluded: business semantics, task orchestration, Git writes, model calls, remote networking, and publish state. See `HARNESS_EXCLUSIONS`.
 
 ## Installation and Minimal Example
 
 ```sh
-npm install skill-family-harness-node@0.10.0
+npm install skill-family-harness-node@0.12.0
 npm info skill-family-harness-node --help
 ```
 
 The minimal example shows validating a contract document inside Node:
 
 ```js
-// Run from an empty directory: npm install skill-family-harness-node@0.10.0
+// Run from an empty directory: npm install skill-family-harness-node@0.12.0
 import { validateContractDocument } from "skill-family-harness-node";
 
 const document = {
@@ -107,6 +100,7 @@ The capability remains **candidate**. Pin all three Foundation packages exactly
 | `writeFileAtomic` | Atomic write: leaves no half-written artifact on failure (temp file + fsync + rename). |
 | `TemporaryWorkspace` / `createTemporaryWorkspace` / `withTemporaryWorkspace` | Auto-cleanup temporary workspace, cleaned up even on exception paths. |
 | `digestBytes` / `computeResourceClosure` / `closureContains` | Resource closure and deterministic sha256 digest. |
+| `superviseProcess` / `validateTimeoutPolicy` | The single bounded subprocess supervisor. Its 0.11.0 `rawSink` option writes raw stdout/stderr bytes only to a fresh canonical private root, then waits for child/stream close, queued writes, fsync, and handle close. The caller must exclusively control the sink namespace for the entire call; handle protection does not prove stable pathname/root identity. |
 | `parseRequest` / `processRequest` | Parse `operation-request`, output terminal `operation-result`. |
 | `validateReportModel` / `renderReportMarkdown` / `buildBinding` / `checkReport` | Consume a Contracts-validated report model, deterministically render neutral Markdown, and verify source/result/report binding; does not interpret business output. |
 | `normalizeAdapterSource` / `buildAdapterClosure` / `verifyAdapterBuildManifest` / `materializeAdapterBuild` | Generic text-source closure, full-manifest digest re-verification, and atomic landing of the target set; specific Profile/driver is not in the Harness. |
@@ -144,7 +138,7 @@ Comparison is based on the canonical root after `realpath`, avoiding misjudgment
 
 ## Testing
 
-`node --test` covers: full Contracts fixture replay, security negative cases, atomic-failure paths, temporary workspaces, closure determinism, report fact binding and Markdown injection, host manifest/path/command trust, and state-store crashes, concurrency, corruption, fencing, explicit recovery, symlinks, hard links, and FIFO negative cases.
+`node --test` covers: full Contracts fixture replay, security negative cases, atomic-failure paths, temporary workspaces, closure determinism, raw sink delayed-stream and failure paths, report fact binding and Markdown injection, host manifest/path/command trust, and state-store crashes, concurrency, corruption, fencing, explicit recovery, symlinks, hard links, and FIFO negative cases.
 
 ## Troubleshooting
 
@@ -178,6 +172,7 @@ Mechanism failures uniformly throw `SFC2004` (EXECUTION_FAILED), with `details.k
 - `foundation.harness.atomic-write`: atomic write within contained paths, rolling back on failure.
 - `foundation.harness.temporary-workspace`: auto-cleanup temporary workspace.
 - `foundation.harness.resource-closure`: deterministic resource closure and sha256 digest.
+- `foundation.harness.supervise-process`: one bounded subprocess supervisor; raw evidence capture remains mechanism-only and does not produce a receipt or domain verdict.
 - `foundation.harness.request-processing`: operation-request → terminal operation-result.
 - `foundation.harness.report`: report-model validation/render/binding/check.
 - `foundation.harness.host-adapter`: adapter source closure/build/materialize, version probe, and read-only peer adapter verification.

package/README.zh-CN.md

@@ -5,29 +5,22 @@
 
 # skill-family-harness-node
 
-<!-- release-skill:release-version: 0.10.0 -->
+<!-- release-skill:release-version: 0.12.0 -->
 
 Contracts 机制协议的**唯一默认 Node 实现**。这是一个薄运行时（thin runtime）：只实现机制协议，不引入业务语义，不做第二语言实现。
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.10.0** (2026-08-24)
+**0.12.0** (2026-08-26)
 
-Harness 0.10.0 增加规范入口，复用既有宿主机制，并从真实目录提供同级适配器只读验证。
-
-**新增**
-
-- 新增 skill-family-harness-node/quickstart-profile 与 skill-family-harness-node/rename-directory-no-replace 规范导出。
-- 复用 filesystem-root binding、严格不替换发布、原子替换和既有构建摘要，支持 Kit 的本地宿主 install/update。
-- 新增 `verifyPeerAdapterDirectories`，重新枚举 peer 根目录，验证共同闭包、逐字节摘要、标准 manifest 和完整 logicalMappings，不写入目录。
+Harness 0.12.0 随 Foundation 三包锁步升级，既有进程与文件系统机制保持不变。
 
 **变更**
 
-- 历史 candidate 导出继续作为同源迁移别名，机制登记表不变。
-- validate-many-by-schema-id 及错误语义不变；受管 Bundle 让历史与规范 Schema ID 共用同一 validator。
+- 将 skill-family-contracts 精确依赖更新为 0.12.0，支持 Engineering Kit 的五平台验证扩展。
 
 **升级说明**
 
-消费者应把三个包的精确 pin 更新到 0.10.0，并把历史 candidate 导入和 Schema ID 一次迁移到规范身份。低层不替换原语仍不同于稳定 fixed-set-publication API，消费者按所需合同选择。
+本版本不新增 Harness API，也不改变运行行为。进程监督、原始字节输出、绑定读取和摘要继续复用既有机制；宿主专属的协议规则由 Engineering Kit 实现。
 <!-- release-skill:managed:end id=latest-release -->
 
 ## 解决的问题
@@ -41,14 +34,14 @@ Harness 消费 `skill-family-contracts`（工作区依赖），复用其方言
 ## 安装和最小示例
 
 ```sh
-npm install skill-family-harness-node@0.10.0
+npm install skill-family-harness-node@0.12.0
 npm info skill-family-harness-node --help
 ```
 
 最小示例演示在 Node 内校验一份契约文档：
 
 ```js
-// 从空目录运行：npm install skill-family-harness-node@0.10.0
+// 从空目录运行：npm install skill-family-harness-node@0.12.0
 import { validateContractDocument } from "skill-family-harness-node";
 
 const document = {
@@ -108,6 +101,7 @@ v2 机制会重算每个 path-backed output 和 evidence Resource 的真实字
 | `writeFileAtomic` | 原子写：失败不留半成品（临时文件 + fsync + rename）。 |
 | `TemporaryWorkspace` / `createTemporaryWorkspace` / `withTemporaryWorkspace` | 自动清理的临时工作区，异常路径也清理。 |
 | `digestBytes` / `computeResourceClosure` / `closureContains` | 资源闭包与确定性 sha256 摘要。 |
+| `superviseProcess` / `validateTimeoutPolicy` | 唯一的受约束子进程监督器。0.11.0 的 `rawSink` 只向 fresh canonical 私有根写原始 stdout/stderr 字节，并等待子进程、流、排队写入、fsync 与句柄全部关闭。调用方必须在整个调用期间独占 sink 命名空间；句柄保护不证明 pathname 或根目录身份始终不变。 |
 | `parseRequest` / `processRequest` | 解析 `operation-request`，输出终态 `operation-result`。 |
 | `validateReportModel` / `renderReportMarkdown` / `buildBinding` / `checkReport` | 消费经 Contracts 验证的 report model，确定性渲染中性 Markdown 并校验来源/结果/报告绑定；不解释业务输出。 |
 | `normalizeAdapterSource` / `buildAdapterClosure` / `verifyAdapterBuildManifest` / `materializeAdapterBuild` | 通用文本 source closure、manifest 全摘要复验和目标集合原子落盘；具体 Profile/driver 不在 Harness。 |
@@ -179,6 +173,7 @@ v2 机制会重算每个 path-backed output 和 evidence Resource 的真实字
 - `foundation.harness.atomic-write`：受收容路径内原子写，失败回滚。
 - `foundation.harness.temporary-workspace`：自动清理的临时工作区。
 - `foundation.harness.resource-closure`：确定性资源闭包与 sha256 摘要。
+- `foundation.harness.supervise-process`：监督一个有界子进程；原始证据收集仍只提供机制，不产生收据或领域结论。
 - `foundation.harness.request-processing`：operation-request → 终态 operation-result。
 - `foundation.harness.report`：report-model 校验/渲染/绑定/检查。
 - `foundation.harness.host-adapter`：adapter source closure/build/materialize 与版本探测。

package/candidate/rename-directory-no-replace/build-prebuild-candidate.mjs

@@ -16,6 +16,7 @@ import {
 import path from "node:path";
 import process from "node:process";
 import { fileURLToPath } from "node:url";
+import { run as runReceiptAssembler } from "../../src/native/receipt-assembler-core.mjs";
 
 const ROOT = path.dirname(fileURLToPath(import.meta.url));
 const SOURCE = path.join(ROOT, "addon", "rename_directory_no_replace.c");
@@ -128,60 +129,35 @@ function replaceManaged(outputRoot, stage, names) {
 }
 
 export function assemble(argv) {
-  const args = parseArgs(argv);
-  const sourceSha = sha256(readFileSync(SOURCE));
-  const inputs = [];
-  for (const key of KEYS) {
-    const receiptPath = path.resolve(args.get(`${key}-receipt`));
-    const binaryPath = path.resolve(args.get(`${key}-binary`));
-    const receipt = readJson(receiptPath);
-    const facts = receiptFacts(key, receipt.document);
-    if (facts.sourceSha !== sourceSha) throw new Error(`${key}: receipt source SHA与current native source不匹配`);
-    verifyBinary(key, binaryPath, facts);
-    inputs.push({ key, receiptSha: receipt.sha256, binaryPath, ...facts });
-  }
-  if (new Set(inputs.map((entry) => entry.sourceSha)).size !== 1) throw new Error("四份receipt的native source SHA不一致");
-
-  const outputRoot = path.resolve(args.get("output-root"));
-  const stage = mkdtempSync(path.join(path.dirname(outputRoot), ".native-prebuild-stage-"));
-  const entries = [];
-  try {
-    for (const input of inputs) {
-      const filename = `rename_directory_no_replace.${input.key}.node`;
-      const relative = `prebuilds/${input.key}/${filename}`;
-      const destination = path.join(stage, relative);
-      mkdirSync(path.dirname(destination), { recursive: true });
-      copyFileSync(input.binaryPath, destination);
-      chmodSync(destination, MODE);
-      entries.push({ platformKey: input.key, ...CONFIG[input.key], binary: relative, mode: MODE, sha256: input.binarySha, napi: Number(NAPI), exports: EXPORTS });
-    }
-    const manifest = { schemaVersion: 2, kind: "skill-family.rename-directory-no-replace-prebuild-manifest", status: "candidate", entries };
-    const sbom = {
+  return runReceiptAssembler({
+    keys: KEYS,
+    platforms: CONFIG,
+    sourceFile: SOURCE,
+    mode: MODE,
+    napi: NAPI,
+    exports: EXPORTS,
+    binaryName: (key) => `rename_directory_no_replace.${key}.node`,
+    extractFacts: (key, receipt) => receiptFacts(key, receipt),
+    manifestDoc: (entries) => ({ schemaVersion: 2, kind: "skill-family.rename-directory-no-replace-prebuild-manifest", status: "candidate", entries }),
+    sbomDoc: (sourceSha, entries) => ({
       schemaVersion: 1,
       kind: "skill-family.rename-directory-no-replace-prebuild-sbom",
       status: "candidate",
       source: { path: EXPECTED_SOURCE, sha256: sourceSha },
       files: entries.map(({ platformKey, binary, sha256: digest }) => ({ platformKey, binary, sha256: digest, license: "Apache-2.0" })),
-    };
-    const releaseReceipt = {
+    }),
+    releaseReceiptDoc: ({ inputs, sourceSha, manifestSha }) => ({
       schemaVersion: 1,
       kind: "skill-family.rename-directory-no-replace-prebuild-release-receipt",
       status: "candidate",
       node: { version: NODE_VERSION, napi: Number(NAPI) },
       source: { path: EXPECTED_SOURCE, sha256: sourceSha },
-      manifestSha256: sha256(Buffer.from(canonical(manifest))),
+      manifestSha256: manifestSha,
       inputs: inputs.map(({ key, receiptSha, binarySha }) => ({ platformKey: key, platformReceiptSha256: receiptSha, binarySha256: binarySha })),
-    };
-    writeFileSync(path.join(stage, "prebuild-manifest.json"), canonical(manifest));
-    writeFileSync(path.join(stage, "prebuild-sbom.json"), canonical(sbom));
-    writeFileSync(path.join(stage, "prebuild-release-receipt.json"), canonical(releaseReceipt));
-    writeFileSync(path.join(stage, "NOTICE"), "Skill Family Foundation rename-directory-no-replace candidate prebuilds\nCompiled from the Apache-2.0 source identified in prebuild-sbom.json.\nNo fallback implementation or stable-registry activation is included.\n");
-    const managed = ["prebuilds", "prebuild-manifest.json", "prebuild-sbom.json", "prebuild-release-receipt.json", "NOTICE"];
-    replaceManaged(outputRoot, stage, managed);
-    return releaseReceipt;
-  } finally {
-    rmSync(stage, { recursive: true, force: true });
-  }
+    }),
+    noticeText: "Skill Family Foundation rename-directory-no-replace candidate prebuilds\nCompiled from the Apache-2.0 source identified in prebuild-sbom.json.\nNo fallback implementation or stable-registry activation is included.\n",
+    managedNames: ["prebuilds", "prebuild-manifest.json", "prebuild-sbom.json", "prebuild-release-receipt.json", "NOTICE"],
+  }, argv);
 }
 
 if (process.argv[1] === fileURLToPath(import.meta.url)) {

package/package.json

@@ -10,7 +10,7 @@
   "dependencies": {
     "@pnpm/lockfile.fs": "1001.1.35",
     "ipaddr.js": "2.5.0",
-    "skill-family-contracts": "0.10.0",
+    "skill-family-contracts": "0.12.0",
     "yaml": "2.9.0"
   },
   "description": "Thin Node.js mechanism runtime for Skill Family engineering contracts.",
@@ -48,7 +48,7 @@
     "url": "https://github.com/ifoohoo/skill-family-harness-node.git"
   },
   "type": "module",
-  "version": "0.10.0",
+  "version": "0.12.0",
   "scripts": {
     "check": "node --test",
     "test": "node --test"

package/release-notes/0.11.0.yaml

@@ -0,0 +1,21 @@
+version: 0.11.0
+date: 2026-08-25
+locales:
+  en:
+    summary: Harness 0.11.0 adds raw-byte subprocess sinks and exposes the bound-read root identity needed by host verification.
+    changes:
+      added:
+        - Extends superviseProcess with an exclusive, no-follow raw stdout/stderr sink that waits for stream close, queued writes, fsync, and close.
+        - Keeps the existing bound-read mechanism as the only root and member read authority.
+      changed:
+        - Carries the previously prepared host Profile closure into the lockstep 0.11.0 family release.
+    upgradeNotes: The raw sink is mechanism-only; it does not create a second process runner, receipt state machine, or host-specific policy. The caller must exclusively control the sink namespace for the whole call; handle protection does not prove stable pathname or root identity.
+  zh-CN:
+    summary: Harness 0.11.0 增加原始字节子进程输出 sink，并暴露真实宿主验证所需的受保护根身份。
+    changes:
+      added:
+        - 为 superviseProcess 增加独占、禁止跟随符号链接的 stdout/stderr 原始字节 sink，并等待流关闭、排队写入、fsync 与 close。
+        - 继续把既有 bound-read 机制作为唯一根目录与成员读取权威。
+      changed:
+        - 把此前准备好的宿主 Profile 闭包并入 0.11.0 三包锁步交付。
+    upgradeNotes: 原始 sink 只提供机制，不建立第二个进程 runner、收据状态机或宿主专属策略。调用方必须在整个调用期间独占 sink 命名空间；句柄保护不证明 pathname 或根目录身份始终不变。

package/release-notes/0.12.0.yaml

@@ -0,0 +1,15 @@
+version: 0.12.0
+date: 2026-08-26
+locales:
+  en:
+    summary: Harness 0.12.0 joins the lockstep Foundation release with its existing process and filesystem mechanisms unchanged.
+    changes:
+      changed:
+        - Pins skill-family-contracts to 0.12.0 for the five-host verification extension implemented by Engineering Kit.
+    upgradeNotes: No new Harness API or runtime behavior is introduced. Existing process supervision, raw-byte sinks, bound reads, and digest mechanisms remain the shared implementation; host-specific protocol rules belong to Engineering Kit.
+  zh-CN:
+    summary: Harness 0.12.0 随 Foundation 三包锁步升级，既有进程与文件系统机制保持不变。
+    changes:
+      changed:
+        - 将 skill-family-contracts 精确依赖更新为 0.12.0，支持 Engineering Kit 的五平台验证扩展。
+    upgradeNotes: 本版本不新增 Harness API，也不改变运行行为。进程监督、原始字节输出、绑定读取和摘要继续复用既有机制；宿主专属的协议规则由 Engineering Kit 实现。

package/src/bound-read.mjs

@@ -176,6 +176,31 @@ function assertRelativePath(relPath) {
   return segments;
 }
 
+// The only closed set of native failure reasons that can prove a static
+// member policy violation. Anything else — unknown reasons, missing root
+// identity, root identity drift, or "native-io" — stays
+// boundary-indeterminate. This set is the stable branching fact between the
+// harness and the Kit; it must never be derived from errno values or error
+// messages.
+const MEMBER_POLICY_FAILURE_REASONS = Object.freeze([
+  "member-missing",
+  "intermediate-not-real-directory",
+  "leaf-symbolic-link",
+  "leaf-not-regular",
+  "leaf-multiple-links",
+]);
+const MEMBER_POLICY_FAILURE_REASON_SET = new Set(MEMBER_POLICY_FAILURE_REASONS);
+
+function nativeBoundReadDisposition(native, captured) {
+  if (native?.rootDevice !== captured.identity.device || native?.rootInode !== captured.identity.inode ||
+      Number(native?.rootMode) !== captured.identity.mode) {
+    return "boundary-indeterminate";
+  }
+  return MEMBER_POLICY_FAILURE_REASON_SET.has(native?.failureReason)
+    ? "member-policy-violation"
+    : "boundary-indeterminate";
+}
+
 export async function readFileBound(root, relPath, { rootBinding, encoding, expectedSha256 } = {}) {
   assertSupportedPlatform();
   assertCanonicalAbsolute(root, "root");
@@ -197,26 +222,36 @@ export async function readFileBound(root, relPath, { rootBinding, encoding, expe
       throw mechanismError(
         HARNESS_ERROR_KINDS.UNSAFE_STATE_ENTRY,
         "approved root binding does not match the current root",
+        { boundReadDisposition: "boundary-indeterminate" },
       );
     }
     const { addon } = await loadNativeBoundReadAddon();
     const native = addon.readFileBoundNative(captured.canonical, segments);
     if (!native?.ok) {
-      const cause = {
-        code: native?.errorCode === (process.platform === "darwin" ? 62 : 40) ? "ELOOP" : native?.errorCode === 2 ? "ENOENT" :
-          native?.errorCode === 20 ? "ENOTDIR" : `errno-${native?.errorCode ?? "unknown"}`,
-      };
-      if (cause.code === "ENOTDIR" && segments.length > 1) {
-        throw mechanismError(HARNESS_ERROR_KINDS.UNSAFE_STATE_ENTRY, "an intermediate component is not a real directory", {
-          input: relPath,
-        });
+      // Disposition is decided only by the two documented conditions: the
+      // native root identity must equal the captured binding, and the native
+      // failureReason must be one of the five closed-set member policy
+      // reasons. The reason also selects the stable details.kind; it is never
+      // derived from errno values or error messages.
+      const boundReadDisposition = nativeBoundReadDisposition(native, captured);
+      const details = { input: relPath, boundReadDisposition };
+      const reason = native?.failureReason;
+      if (reason === "intermediate-not-real-directory") {
+        throw mechanismError(HARNESS_ERROR_KINDS.UNSAFE_STATE_ENTRY, "an intermediate component is not a real directory", details);
+      }
+      if (reason === "leaf-symbolic-link") {
+        throw mechanismError(HARNESS_ERROR_KINDS.UNSAFE_STATE_ENTRY, "bound path became a symbolic link during read", details);
+      }
+      if (reason === "member-missing") {
+        throw mechanismError(HARNESS_ERROR_KINDS.MISSING_RESOURCE, "bound path does not exist during read", details);
       }
-      mapOpenFailure(cause, relPath, segments.length > 1 ? "bound path" : "leaf");
+      throw mechanismError(HARNESS_ERROR_KINDS.READ_FAILED, `bound path could not be read: ${reason ?? "native-io"}`, details);
     }
     if (native.rootDevice !== captured.identity.device || native.rootInode !== captured.identity.inode ||
         Number(native.rootMode) !== captured.identity.mode) {
       throw mechanismError(HARNESS_ERROR_KINDS.UNSAFE_STATE_ENTRY, "root identity changed during bound read", {
         input: relPath,
+        boundReadDisposition: "boundary-indeterminate",
       });
     }
     const bytes = Buffer.from(native.bytes);
@@ -234,6 +269,7 @@ export async function readFileBound(root, relPath, { rootBinding, encoding, expe
       sha256,
       bytes: bytes.length,
       mode: Number(native.leafMode),
+      rootMode: captured.identity.mode,
     });
   } finally {
     await captured.handle.close().catch(() => {});

package/src/native/NOTICE

@@ -1,3 +1,2 @@
-Skill Family Foundation stable filesystem native prebuilds (bound-read and fixed-set publication).
-Compiled from the Apache-2.0 source identified in prebuild-sbom.json.
-The closure contains no JavaScript fallback and no candidate entry-point dependency.
+Skill Family Foundation filesystem bound-read stable prebuilds
+Generated only from four verified platform receipts.

package/src/native/assemble-stable-prebuild.mjs

@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+import { assertSha256Hex, runCli } from "./receipt-assembler-core.mjs";
+
+const ROOT = path.dirname(fileURLToPath(import.meta.url));
+const SOURCE = path.join(ROOT, "bound_read.c");
+const BINDING_GYP = path.join(ROOT, "binding.gyp");
+const KEYS = Object.freeze(["darwin-arm64", "darwin-x64", "linux-arm64-gnu", "linux-x64-gnu"]);
+const PLATFORMS = Object.freeze({
+  "darwin-arm64": { os: "darwin", arch: "arm64", libc: "none" },
+  "darwin-x64": { os: "darwin", arch: "x64", libc: "none" },
+  "linux-arm64-gnu": { os: "linux", arch: "arm64", libc: "glibc" },
+  "linux-x64-gnu": { os: "linux", arch: "x64", libc: "glibc" },
+});
+const EXPORTS = Object.freeze(["closeParentDirectory", "openParentDirectory", "platform", "readFileBoundNative", "renameDirectoryNoReplace"]);
+const sha256 = (bytes) => createHash("sha256").update(bytes).digest("hex");
+const bindingGypSha256 = sha256(readFileSync(BINDING_GYP));
+
+function extractFacts(key, receipt, { sourceSha }) {
+  const expected = PLATFORMS[key];
+  if (receipt?.kind !== "skill-family.filesystem-bound-read-platform-receipt" || receipt.status !== "VERIFIED" ||
+      receipt.actualExecution !== true || receipt.platformKey !== key || receipt.node?.version !== "v22.23.2" ||
+      Number(receipt.node?.napi) !== 10 || receipt.platform?.os !== expected.os || receipt.platform?.arch !== expected.arch ||
+      receipt.platform?.libc !== expected.libc || receipt.source?.sha256 !== sourceSha ||
+      receipt.buildRecipe?.sha256 !== bindingGypSha256 || receipt.addon?.mode !== "0644" ||
+      receipt.addon?.size === undefined || JSON.stringify(receipt.addon?.exports) !== JSON.stringify(EXPORTS) ||
+      !Array.isArray(receipt.oracle?.results) || receipt.oracle.results.length === 0 || !receipt.oracle.results.every((result) => result.status === "PASS")) {
+    throw new Error(`${key}: stable receipt does not prove the fixed platform execution contract`);
+  }
+  return { sourceSha, binarySha: assertSha256Hex(receipt.addon.sha256, `${key} addon sha256`), binarySize: receipt.addon.size, binaryMode: 0o644 };
+}
+
+runCli({
+  keys: KEYS, platforms: PLATFORMS, sourceFile: SOURCE, mode: 0o644, napi: 10, exports: EXPORTS,
+  binaryName: (key) => `bound_read.${key}.node`, extractFacts,
+  manifestDoc: (entries) => ({ schemaVersion: 1, kind: "skill-family.filesystem-bound-read-prebuild-manifest", status: "stable", entries }),
+  sbomDoc: (sourceSha, entries) => ({ schemaVersion: 1, kind: "skill-family.filesystem-bound-read-prebuild-sbom", status: "stable", source: { path: "packages/skill-family-harness-node/src/native/bound_read.c", sha256: sourceSha }, buildRecipe: { path: "packages/skill-family-harness-node/src/native/binding.gyp", sha256: bindingGypSha256 }, files: entries.map(({ platformKey, binary, sha256: digest }) => ({ platformKey, binary, sha256: digest, license: "Apache-2.0" })) }),
+  releaseReceiptDoc: ({ inputs, sourceSha, manifestSha }) => ({ schemaVersion: 1, kind: "skill-family.filesystem-bound-read-prebuild-release-receipt", status: "stable", node: { version: "v22.23.2", napi: 10 }, source: { path: "packages/skill-family-harness-node/src/native/bound_read.c", sha256: sourceSha }, buildRecipe: { path: "packages/skill-family-harness-node/src/native/binding.gyp", sha256: bindingGypSha256 }, manifestSha256: manifestSha, inputs: inputs.map(({ key, receiptSha, binarySha }) => ({ platformKey: key, platformReceiptSha256: receiptSha, binarySha256: binarySha })) }),
+  noticeText: "Skill Family Foundation filesystem bound-read stable prebuilds\nGenerated only from four verified platform receipts.\n",
+  managedNames: ["prebuilds", "prebuild-manifest.json", "prebuild-sbom.json", "prebuild-release-receipt.json", "NOTICE"],
+}, process.argv.slice(2));

package/src/native/binding.gyp

@@ -0,0 +1,25 @@
+{
+  "targets": [
+    {
+      "target_name": "bound_read",
+      "sources": ["bound_read.c"],
+      "cflags": ["-Wall", "-Wextra", "-Werror", "-std=c11"],
+      "xcode_settings": {
+        "GCC_GENERATE_DEBUGGING_SYMBOLS": "NO",
+        "OTHER_CFLAGS": [
+          "-Wall", "-Wextra", "-Werror", "-std=c11",
+          "-ffile-prefix-map=<(module_root_dir)=.",
+          "-fdebug-prefix-map=<(module_root_dir)=."
+        ]
+      },
+      "conditions": [
+        ["OS=='mac'", {
+          "defines": ["PLATFORM_DARWIN=1"]
+        }],
+        ["OS=='linux'", {
+          "defines": ["PLATFORM_LINUX=1"]
+        }]
+      ]
+    }
+  ]
+}