skill-family-harness-node 0.19.3 → 0.20.0

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.20.0 locale=en baseline=sha256:07e569fb3b5eb03df9a79953aec17b84d25b433b6b031da4cae9e757d60e3f4e -->
+## [0.20.0] - 2026-09-10
+
+Harness 0.20.0 aligns with Contracts 1.18.0 and Foundation 0.20.0 without adding a new runtime mechanism.
+
+### Changed
+
+- Aligns package identity and published projections with the lockstep Foundation 0.20.0 release.
+- Reuses the existing process supervision, binding, snapshot, and private-output mechanisms for the Cursor driver implemented by Engineering Kit.
+
+### Upgrade Notes
+
+Pin all three Foundation packages to exactly 0.20.0. Harness adds no Cursor-specific runtime layer or automatic trust behavior.
+<!-- release-skill:changelog:end version=0.20.0 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.19.3 locale=en baseline=sha256:097787640991b8387edbe6a292c2c3249b6cfe51502288f4b186daaa8e42163c -->
 ## [0.19.3] - 2026-09-08
 

package/CHANGELOG.zh-CN.md

@@ -1,5 +1,21 @@
 # 变更日志
 
+<!-- release-skill:changelog:start version=0.20.0 locale=zh-CN baseline=sha256:b02138525f60fd7aed125a9f0712090cf3d918e109b7e86361b86e6d044330cf -->
+## [0.20.0] - 2026-09-10
+
+Harness 0.20.0 与 Contracts 1.18.0 和 Foundation 0.20.0 对齐，不增加新的运行时机制。
+
+### 变更
+
+- 包身份和公开投影与 Foundation 0.20.0 锁步版本对齐。
+- Engineering Kit 的 Cursor 驱动继续复用既有进程监督、绑定、快照和私有输出机制。
+
+### 升级说明
+
+三个 Foundation 包须一起精确锁定到 0.20.0。Harness 不增加 Cursor 专属运行层，也不增加自动信任行为。
+<!-- release-skill:changelog:end version=0.20.0 locale=zh-CN -->
+
+
 <!-- release-skill:changelog:start version=0.19.3 locale=zh-CN baseline=sha256:bd93b40eb86b9acf3deb13b5f8f905f6c26ae4aa36da17a2045c3d51dac2f7c3 -->
 ## [0.19.3] - 2026-09-08
 

package/README.md

@@ -4,22 +4,23 @@
 
 # skill-family-harness-node
 
-<!-- release-skill:release-version: 0.19.3 -->
+<!-- release-skill:release-version: 0.20.0 -->
 
 The **single default Node implementation** of the Contracts mechanism protocol. This is a thin runtime: it only implements the mechanism protocol, introduces no business semantics, and does not provide a second-language implementation.
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.19.3** (2026-09-08)
+**0.20.0** (2026-09-10)
 
-Harness 0.19.3 aligns its package and release documentation with the Foundation Adoption Review Qoder distribution patch. Existing mechanisms and runtime behavior are unchanged.
+Harness 0.20.0 aligns with Contracts 1.18.0 and Foundation 0.20.0 without adding a new runtime mechanism.
 
 **Changed**
 
-- Aligns the package version, release documentation, and verified public package projection with Foundation 0.19.3 without changing Harness implementation or driver behavior.
+- Aligns package identity and published projections with the lockstep Foundation 0.20.0 release.
+- Reuses the existing process supervision, binding, snapshot, and private-output mechanisms for the Cursor driver implemented by Engineering Kit.
 
 **Upgrade Notes**
 
-Pin all three Foundation packages to exactly 0.19.3. This patch adds no Harness capability and does not change host descriptors, drivers, since values, or maturity.
+Pin all three Foundation packages to exactly 0.20.0. Harness adds no Cursor-specific runtime layer or automatic trust behavior.
 <!-- release-skill:managed:end id=latest-release -->
 
 ## Problem It Solves
@@ -32,7 +33,7 @@ The Harness consumes `skill-family-contracts` (a workspace dependency), reusing
 
 ## Installation and Minimal Example
 
-Version 0.19.3 is the local source candidate. Build all three tarballs into one temporary directory and install those exact files for a candidate check:
+Version 0.20.0 is the local source candidate. Build all three tarballs into one temporary directory and install those exact files for a candidate check:
 
 ```sh
 pack_dir="$(mktemp -d)"
@@ -40,13 +41,13 @@ pack_dir="$(mktemp -d)"
 (cd packages/skill-family-harness-node && pnpm pack --pack-destination "$pack_dir")
 (cd packages/skill-family-engineering-kit && pnpm pack --pack-destination "$pack_dir")
 mkdir "$pack_dir/consumer" && (cd "$pack_dir/consumer" && npm init -y)
-(cd "$pack_dir/consumer" && npm install "$pack_dir/skill-family-contracts-0.19.3.tgz" "$pack_dir/skill-family-harness-node-0.19.3.tgz" "$pack_dir/skill-family-engineering-kit-0.19.3.tgz")
+(cd "$pack_dir/consumer" && npm install "$pack_dir/skill-family-contracts-0.20.0.tgz" "$pack_dir/skill-family-harness-node-0.20.0.tgz" "$pack_dir/skill-family-engineering-kit-0.20.0.tgz")
 ```
 
 After publication, use the registry coordinate:
 
 ```sh
-npm install skill-family-harness-node@0.19.3
+npm install skill-family-harness-node@0.20.0
 npm info skill-family-harness-node --help
 ```
 
@@ -255,4 +256,4 @@ When the actual threat includes malicious concurrency, return a minimal upstream
 
 The separate candidate `observeExecutableIdentity({ boundRoots, lookup, interpreterPolicy? })` provides a read-only point-in-time observation of only the caller-explicit roots and lookup paths, for an immediate re-observation before launch. When an `/usr/bin/env` shebang resolves an interpreter through explicit `pathEntries`, the observation preserves the interpreter candidate's complete symlink chain rather than collapsing it to the final file. It is not part of `host-adapter` and does not prove wrapper control flow, ambient `PATH`, fd-exec/kernel image, signature trust, cross-call caching, host support/lifecycle, or domain acceptance; the caller owns those semantics. The candidate entry alone does not qualify a host.
 
-Version 0.19.3 is the local source candidate. Remote availability must be established by the corresponding release-skill post-release evidence. Consume the three locally verified tarballs for candidate checks; a version marker, unit test, or successful install is not complete contract integration, migration completion, or real-host qualification.
+Version 0.20.0 is the local source candidate. Remote availability must be established by the corresponding release-skill post-release evidence. Consume the three locally verified tarballs for candidate checks; a version marker, unit test, or successful install is not complete contract integration, migration completion, or real-host qualification.

package/README.zh-CN.md

@@ -5,22 +5,23 @@
 
 # skill-family-harness-node
 
-<!-- release-skill:release-version: 0.19.3 -->
+<!-- release-skill:release-version: 0.20.0 -->
 
 Contracts 机制协议的**唯一默认 Node 实现**。这是一个薄运行时（thin runtime）：只实现机制协议，不引入业务语义，不做第二语言实现。
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.19.3** (2026-09-08)
+**0.20.0** (2026-09-10)
 
-Harness 0.19.3 将包版本和发布文档与 Foundation Adoption Review 的 Qoder 分发补丁对齐。既有机制和运行时行为保持不变。
+Harness 0.20.0 与 Contracts 1.18.0 和 Foundation 0.20.0 对齐，不增加新的运行时机制。
 
 **变更**
 
-- 包版本、发布文档和经验证的公开 package.json 投影与 Foundation 0.19.3 数值对齐；Harness 实现和 driver 行为不变。
+- 包身份和公开投影与 Foundation 0.20.0 锁步版本对齐。
+- Engineering Kit 的 Cursor 驱动继续复用既有进程监督、绑定、快照和私有输出机制。
 
 **升级说明**
 
-三个 Foundation 包须一起精确锁定到 0.19.3。本补丁不增加 Harness 能力，不改变宿主 descriptor、driver、since 字段或成熟度。
+三个 Foundation 包须一起精确锁定到 0.20.0。Harness 不增加 Cursor 专属运行层，也不增加自动信任行为。
 <!-- release-skill:managed:end id=latest-release -->
 
 ## 解决的问题
@@ -33,7 +34,7 @@ Harness 消费 `skill-family-contracts`（工作区依赖），复用其方言
 
 ## 安装和最小示例
 
-0.19.3 是本地源码候选。候选验证先把三个包分别打入同一个临时目录，再安装这三个精确 tarball：
+0.20.0 是本地源码候选。候选验证先把三个包分别打入同一个临时目录，再安装这三个精确 tarball：
 
 ```sh
 pack_dir="$(mktemp -d)"
@@ -41,13 +42,13 @@ pack_dir="$(mktemp -d)"
 (cd packages/skill-family-harness-node && pnpm pack --pack-destination "$pack_dir")
 (cd packages/skill-family-engineering-kit && pnpm pack --pack-destination "$pack_dir")
 mkdir "$pack_dir/consumer" && (cd "$pack_dir/consumer" && npm init -y)
-(cd "$pack_dir/consumer" && npm install "$pack_dir/skill-family-contracts-0.19.3.tgz" "$pack_dir/skill-family-harness-node-0.19.3.tgz" "$pack_dir/skill-family-engineering-kit-0.19.3.tgz")
+(cd "$pack_dir/consumer" && npm install "$pack_dir/skill-family-contracts-0.20.0.tgz" "$pack_dir/skill-family-harness-node-0.20.0.tgz" "$pack_dir/skill-family-engineering-kit-0.20.0.tgz")
 ```
 
 发布后再使用 registry 坐标：
 
 ```sh
-npm install skill-family-harness-node@0.19.3
+npm install skill-family-harness-node@0.20.0
 npm info skill-family-harness-node --help
 ```
 
@@ -255,4 +256,4 @@ v2 机制会重算每个 path-backed output 和 evidence Resource 的真实字
 
 另一个独立候选 `observeExecutableIdentity({ boundRoots, lookup, interpreterPolicy? })` 只对调用方显式提供的根和查找路径做逐次只读观察，供正式启动前紧邻重观察。`/usr/bin/env` shebang 通过显式 `pathEntries` 找到解释器时，结果保留解释器候选的完整 symlink chain，不折叠成最终文件。它不属于 `host-adapter`，也不证明 wrapper 控制流、ambient `PATH`、fd-exec/内核映像、签名信任、跨调用缓存、宿主支持/生命周期或领域接受；这些语义仍由调用方负责。候选入口存在不等于宿主已获资格。
 
-0.19.3 是本地源码候选，远端可用性须由对应的 release-skill 发布后证据证明。候选检查使用本地已验证的三包 tarball；版本标记、单元测试或安装成功都不等于契约接入完成、迁移完成或真实宿主资格。
+0.20.0 是本地源码候选，远端可用性须由对应的 release-skill 发布后证据证明。候选检查使用本地已验证的三包 tarball；版本标记、单元测试或安装成功都不等于契约接入完成、迁移完成或真实宿主资格。

package/package.json

@@ -10,7 +10,7 @@
   "dependencies": {
     "@pnpm/lockfile.fs": "1001.1.35",
     "ipaddr.js": "2.5.0",
-    "skill-family-contracts": "0.19.3",
+    "skill-family-contracts": "0.20.0",
     "yaml": "2.9.0"
   },
   "description": "Thin Node.js mechanism runtime for Skill Family engineering contracts.",
@@ -49,7 +49,7 @@
     "url": "https://github.com/ifoohoo/skill-family-harness-node.git"
   },
   "type": "module",
-  "version": "0.19.3",
+  "version": "0.20.0",
   "scripts": {
     "check": "node --test",
     "test": "node --test"

package/release-notes/0.20.0.yaml

@@ -0,0 +1,17 @@
+version: 0.20.0
+date: 2026-09-10
+locales:
+  en:
+    summary: Harness 0.20.0 aligns with Contracts 1.18.0 and Foundation 0.20.0 without adding a new runtime mechanism.
+    changes:
+      changed:
+        - Aligns package identity and published projections with the lockstep Foundation 0.20.0 release.
+        - Reuses the existing process supervision, binding, snapshot, and private-output mechanisms for the Cursor driver implemented by Engineering Kit.
+    upgradeNotes: Pin all three Foundation packages to exactly 0.20.0. Harness adds no Cursor-specific runtime layer or automatic trust behavior.
+  zh-CN:
+    summary: Harness 0.20.0 与 Contracts 1.18.0 和 Foundation 0.20.0 对齐，不增加新的运行时机制。
+    changes:
+      changed:
+        - 包身份和公开投影与 Foundation 0.20.0 锁步版本对齐。
+        - Engineering Kit 的 Cursor 驱动继续复用既有进程监督、绑定、快照和私有输出机制。
+    upgradeNotes: 三个 Foundation 包须一起精确锁定到 0.20.0。Harness 不增加 Cursor 专属运行层，也不增加自动信任行为。

package/src/version.mjs

@@ -1,2 +1,2 @@
 /** Exact Foundation release coordinate shared by the public Harness exports. */
-export const FOUNDATION_PACKAGE_VERSION = "0.19.3";
+export const FOUNDATION_PACKAGE_VERSION = "0.20.0";