skill-family-harness-node 0.22.0 → 0.23.0

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.23.0 locale=en baseline=sha256:e4a97088bca9e0c1f48f2bfd5860dbd8be041a9d0a5e42051422767b3b284303 -->
+## [0.23.0] - 2026-09-26
+
+Harness 0.23.0 aligns its package coordinate with Foundation 0.23.0 and adds no runtime mechanism. This note records the local lockstep candidate and does not claim remote publication or real-host acceptance.
+
+### Changed
+
+- Aligns package identity and `FOUNDATION_PACKAGE_VERSION` with the lockstep Foundation 0.23.0 coordinate. The exported file-set apply, recovery, and material-cleanup surface, and the bounded state-store lock inspection and recovery extension, stay as published in 0.22.0.
+- Adds no root export, locking algorithm, directory operation, or platform qualification.
+
+### Upgrade Notes
+
+Pin all three Foundation packages to exactly 0.23.0. Callers keep the 0.22.0 Harness mechanism. Contracts remains specification 1.20.0. Remote publication and real-host verification are outside this note.
+<!-- release-skill:changelog:end version=0.23.0 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.22.0 locale=en baseline=sha256:704d9a47cc28bc1f7358e2817b266cbc83c27a5d3bded306299705a59f7bb05b -->
 ## [0.22.0] - 2026-09-18
 

package/CHANGELOG.zh-CN.md

@@ -1,5 +1,21 @@
 # 变更日志
 
+<!-- release-skill:changelog:start version=0.23.0 locale=zh-CN baseline=sha256:4cfe7a3090bb5589fdbfec555506c0f6a6c668aa872c85c627153e7efa8a6371 -->
+## [0.23.0] - 2026-09-26
+
+Harness 0.23.0 与 Foundation 0.23.0 对齐包坐标，不增加运行时机制。本说明只记录本地锁步候选，不表示已经远端发布，也不表示真实宿主已经接受。
+
+### 变更
+
+- 包身份和 `FOUNDATION_PACKAGE_VERSION` 与 Foundation 0.23.0 锁步坐标对齐。0.22.0 已发布的文件集合应用、恢复和材料清理导出，以及状态底座上有界的锁观察与锁恢复扩展，保持不变。
+- 不新增包根导出、锁算法、目录操作或平台资格。
+
+### 升级说明
+
+三个 Foundation 包须一起精确锁定到 0.23.0。调用方继续使用 0.22.0 的 Harness 机制。Contracts 规格仍是 1.20.0。远端发布和真实宿主验证不在本说明范围内。
+<!-- release-skill:changelog:end version=0.23.0 locale=zh-CN -->
+
+
 <!-- release-skill:changelog:start version=0.22.0 locale=zh-CN baseline=sha256:c06c001717b465cbff9ff239961fc3c873a2c0d39e09594ed885b84323da5bb5 -->
 ## [0.22.0] - 2026-09-18
 

package/README.md

@@ -4,27 +4,23 @@
 
 # skill-family-harness-node
 
-<!-- release-skill:release-version: 0.22.0 -->
+<!-- release-skill:release-version: 0.23.0 -->
 
 The **single default Node implementation** of the Contracts mechanism protocol. This is a thin runtime: it only implements the mechanism protocol, introduces no business semantics, and does not provide a second-language implementation.
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.22.0** (2026-09-18)
+**0.23.0** (2026-09-26)
 
-Harness 0.22.0 adds the multi-path ordinary-file apply, recovery, and material-cleanup mechanism through three package-root exports, and gives the durable state store a bounded lock-inspection and lock-recovery extension.
-
-**Added**
-
-- Adds `applyFileSet`, `recoverFileSet`, and `pruneFileSetRecovery` as package-root exports of `skill-family-harness-node`, composing the existing strict single-file primitives, bound read, and durable state store.
-- Adds `inspectStateStoreLock` and `recoverStateStoreLock` so a caller can observe lock state and repair an interrupted state-store operation without clearing the store's internal files.
+Harness 0.23.0 aligns its package coordinate with Foundation 0.23.0 and adds no runtime mechanism. This note records the local lockstep candidate and does not claim remote publication or real-host acceptance.
 
 **Changed**
 
-- Records whole-set preflight, inverse operations, strict synchronization, and per-path unknown facts while keeping caller-owned domain validation read-only.
+- Aligns package identity and `FOUNDATION_PACKAGE_VERSION` with the lockstep Foundation 0.23.0 coordinate. The exported file-set apply, recovery, and material-cleanup surface, and the bounded state-store lock inspection and recovery extension, stay as published in 0.22.0.
+- Adds no root export, locking algorithm, directory operation, or platform qualification.
 
 **Upgrade Notes**
 
-Pin all three Foundation packages to exactly 0.22.0. Callers must stop old participants and establish an external exclusive maintenance window before recovery; domain verdicts, business plans, and cleanup authorization remain caller responsibilities. The mechanism does not add a second logging or locking algorithm, directory operations, or a platform guarantee beyond darwin/arm64 APFS.
+Pin all three Foundation packages to exactly 0.23.0. Callers keep the 0.22.0 Harness mechanism. Contracts remains specification 1.20.0. Remote publication and real-host verification are outside this note.
 <!-- release-skill:managed:end id=latest-release -->
 
 ## Problem It Solves
@@ -37,7 +33,7 @@ The Harness consumes `skill-family-contracts` (a workspace dependency), reusing
 
 ## Installation and Minimal Example
 
-Version 0.22.0 is the local source candidate. Build all three tarballs into one temporary directory and install those exact files for a candidate check:
+Version 0.23.0 is the local source candidate and is not yet formally published. Version 0.22.0 remains the published package. Build all three tarballs into one temporary directory and install those exact files for a candidate check:
 
 ```sh
 pack_dir="$(mktemp -d)"
@@ -45,13 +41,13 @@ pack_dir="$(mktemp -d)"
 (cd packages/skill-family-harness-node && pnpm pack --pack-destination "$pack_dir")
 (cd packages/skill-family-engineering-kit && pnpm pack --pack-destination "$pack_dir")
 mkdir "$pack_dir/consumer" && (cd "$pack_dir/consumer" && npm init -y)
-(cd "$pack_dir/consumer" && npm install "$pack_dir/skill-family-contracts-0.22.0.tgz" "$pack_dir/skill-family-harness-node-0.22.0.tgz" "$pack_dir/skill-family-engineering-kit-0.22.0.tgz")
+(cd "$pack_dir/consumer" && npm install "$pack_dir/skill-family-contracts-0.23.0.tgz" "$pack_dir/skill-family-harness-node-0.23.0.tgz" "$pack_dir/skill-family-engineering-kit-0.23.0.tgz")
 ```
 
-After publication, use the registry coordinate:
+After 0.23.0 is formally published, use the registry coordinate:
 
 ```sh
-npm install skill-family-harness-node@0.22.0
+npm install skill-family-harness-node@0.23.0
 npm info skill-family-harness-node --help
 ```
 
@@ -291,4 +287,4 @@ When the actual threat includes malicious concurrency, return a minimal upstream
 
 The separate candidate `observeExecutableIdentity({ boundRoots, lookup, interpreterPolicy? })` provides a read-only point-in-time observation of only the caller-explicit roots and lookup paths, for an immediate re-observation before launch. When an `/usr/bin/env` shebang resolves an interpreter through explicit `pathEntries`, the observation preserves the interpreter candidate's complete symlink chain rather than collapsing it to the final file. It is not part of `host-adapter` and does not prove wrapper control flow, ambient `PATH`, fd-exec/kernel image, signature trust, cross-call caching, host support/lifecycle, or domain acceptance; the caller owns those semantics. The candidate entry alone does not qualify a host.
 
-Version 0.22.0 is the local source candidate. Remote availability must be established by the corresponding release-skill post-release evidence. Consume the three locally verified tarballs for candidate checks; a version marker, unit test, or successful install is not complete contract integration, migration completion, or real-host qualification.
+Version 0.23.0 is the local source candidate and is not yet formally published. Version 0.22.0 remains the published package. Remote availability of 0.23.0 must be established by the corresponding release-skill post-release evidence. Consume the three locally verified tarballs for candidate checks; a version marker, unit test, or successful install is not complete contract integration, migration completion, or real-host qualification.

package/README.zh-CN.md

@@ -5,27 +5,23 @@
 
 # skill-family-harness-node
 
-<!-- release-skill:release-version: 0.22.0 -->
+<!-- release-skill:release-version: 0.23.0 -->
 
 Contracts 机制协议的**唯一默认 Node 实现**。这是一个薄运行时（thin runtime）：只实现机制协议，不引入业务语义，不做第二语言实现。
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.22.0** (2026-09-18)
+**0.23.0** (2026-09-26)
 
-Harness 0.22.0 通过三个包根导出增加多路径普通文件的应用、恢复与材料清理机制，并给持久状态底座增加有界的锁观察与锁恢复扩展。
-
-**新增**
-
-- 增加 `applyFileSet`、`recoverFileSet`、`pruneFileSetRecovery` 三个 `skill-family-harness-node` 包根导出，组合既有的严格单文件原语、绑定读取和持久状态底座。
-- 增加 `inspectStateStoreLock` 与 `recoverStateStoreLock`，调用方可以观察锁状态并修复被中断的状态底座操作，而不清理其内部文件。
+Harness 0.23.0 与 Foundation 0.23.0 对齐包坐标，不增加运行时机制。本说明只记录本地锁步候选，不表示已经远端发布，也不表示真实宿主已经接受。
 
 **变更**
 
-- 记录整组前检、逆操作、严格同步和逐路径未知事实，同时保持调用方持有的领域验证只读。
+- 包身份和 `FOUNDATION_PACKAGE_VERSION` 与 Foundation 0.23.0 锁步坐标对齐。0.22.0 已发布的文件集合应用、恢复和材料清理导出，以及状态底座上有界的锁观察与锁恢复扩展，保持不变。
+- 不新增包根导出、锁算法、目录操作或平台资格。
 
 **升级说明**
 
-三个 Foundation 包须一起精确锁定到 0.22.0。恢复前调用方必须停止旧参与者并建立外部排他维护区间；领域判定、业务计划和清理授权仍由调用方负责。本机制不新增第二套日志或锁算法、不扩大为目录操作，也不在 darwin/arm64 APFS 之外承诺平台资格。
+三个 Foundation 包须一起精确锁定到 0.23.0。调用方继续使用 0.22.0 的 Harness 机制。Contracts 规格仍是 1.20.0。远端发布和真实宿主验证不在本说明范围内。
 <!-- release-skill:managed:end id=latest-release -->
 
 ## 解决的问题
@@ -38,7 +34,7 @@ Harness 消费 `skill-family-contracts`（工作区依赖），复用其方言
 
 ## 安装和最小示例
 
-0.22.0 是本地源码候选。候选验证先把三个包分别打入同一个临时目录，再安装这三个精确 tarball：
+0.23.0 是尚未正式发布的本地源码候选；0.22.0 是已发布包。候选验证先把三个包分别打入同一个临时目录，再安装这三个精确 tarball：
 
 ```sh
 pack_dir="$(mktemp -d)"
@@ -46,13 +42,13 @@ pack_dir="$(mktemp -d)"
 (cd packages/skill-family-harness-node && pnpm pack --pack-destination "$pack_dir")
 (cd packages/skill-family-engineering-kit && pnpm pack --pack-destination "$pack_dir")
 mkdir "$pack_dir/consumer" && (cd "$pack_dir/consumer" && npm init -y)
-(cd "$pack_dir/consumer" && npm install "$pack_dir/skill-family-contracts-0.22.0.tgz" "$pack_dir/skill-family-harness-node-0.22.0.tgz" "$pack_dir/skill-family-engineering-kit-0.22.0.tgz")
+(cd "$pack_dir/consumer" && npm install "$pack_dir/skill-family-contracts-0.23.0.tgz" "$pack_dir/skill-family-harness-node-0.23.0.tgz" "$pack_dir/skill-family-engineering-kit-0.23.0.tgz")
 ```
 
-发布后再使用 registry 坐标：
+0.23.0 正式发布后，再使用对应的 registry 坐标：
 
 ```sh
-npm install skill-family-harness-node@0.22.0
+npm install skill-family-harness-node@0.23.0
 npm info skill-family-harness-node --help
 ```
 
@@ -290,4 +286,4 @@ const store = await recoverStateStoreLock(stateStoreRoot, {
 
 另一个独立候选 `observeExecutableIdentity({ boundRoots, lookup, interpreterPolicy? })` 只对调用方显式提供的根和查找路径做逐次只读观察，供正式启动前紧邻重观察。`/usr/bin/env` shebang 通过显式 `pathEntries` 找到解释器时，结果保留解释器候选的完整 symlink chain，不折叠成最终文件。它不属于 `host-adapter`，也不证明 wrapper 控制流、ambient `PATH`、fd-exec/内核映像、签名信任、跨调用缓存、宿主支持/生命周期或领域接受；这些语义仍由调用方负责。候选入口存在不等于宿主已获资格。
 
-0.22.0 是本地源码候选，远端可用性须由对应的 release-skill 发布后证据证明。候选检查使用本地已验证的三包 tarball；版本标记、单元测试或安装成功都不等于契约接入完成、迁移完成或真实宿主资格。
+0.23.0 是尚未正式发布的本地源码候选；0.22.0 是已发布包。0.23.0 的远端可用性须由对应的 release-skill 发布后证据证明。候选检查使用本地已验证的三包 tarball；版本标记、单元测试或安装成功都不等于契约接入完成、迁移完成或真实宿主资格。

package/package.json

@@ -10,7 +10,7 @@
   "dependencies": {
     "@pnpm/lockfile.fs": "1001.1.35",
     "ipaddr.js": "2.5.0",
-    "skill-family-contracts": "0.22.0",
+    "skill-family-contracts": "0.23.0",
     "yaml": "2.9.0"
   },
   "description": "Thin Node.js mechanism runtime for Skill Family engineering contracts.",
@@ -49,7 +49,7 @@
     "url": "https://github.com/ifoohoo/skill-family-harness-node.git"
   },
   "type": "module",
-  "version": "0.22.0",
+  "version": "0.23.0",
   "scripts": {
     "check": "node --test",
     "test": "node --test"

package/release-notes/0.23.0.yaml

@@ -0,0 +1,17 @@
+version: 0.23.0
+date: 2026-09-26
+locales:
+  en:
+    summary: Harness 0.23.0 aligns its package coordinate with Foundation 0.23.0 and adds no runtime mechanism. This note records the local lockstep candidate and does not claim remote publication or real-host acceptance.
+    changes:
+      changed:
+        - Aligns package identity and `FOUNDATION_PACKAGE_VERSION` with the lockstep Foundation 0.23.0 coordinate. The exported file-set apply, recovery, and material-cleanup surface, and the bounded state-store lock inspection and recovery extension, stay as published in 0.22.0.
+        - Adds no root export, locking algorithm, directory operation, or platform qualification.
+    upgradeNotes: Pin all three Foundation packages to exactly 0.23.0. Callers keep the 0.22.0 Harness mechanism. Contracts remains specification 1.20.0. Remote publication and real-host verification are outside this note.
+  zh-CN:
+    summary: Harness 0.23.0 与 Foundation 0.23.0 对齐包坐标，不增加运行时机制。本说明只记录本地锁步候选，不表示已经远端发布，也不表示真实宿主已经接受。
+    changes:
+      changed:
+        - 包身份和 `FOUNDATION_PACKAGE_VERSION` 与 Foundation 0.23.0 锁步坐标对齐。0.22.0 已发布的文件集合应用、恢复和材料清理导出，以及状态底座上有界的锁观察与锁恢复扩展，保持不变。
+        - 不新增包根导出、锁算法、目录操作或平台资格。
+    upgradeNotes: 三个 Foundation 包须一起精确锁定到 0.23.0。调用方继续使用 0.22.0 的 Harness 机制。Contracts 规格仍是 1.20.0。远端发布和真实宿主验证不在本说明范围内。

package/src/version.mjs

@@ -1,2 +1,2 @@
 /** Exact Foundation release coordinate shared by the public Harness exports. */
-export const FOUNDATION_PACKAGE_VERSION = "0.22.0";
+export const FOUNDATION_PACKAGE_VERSION = "0.23.0";