skill-family-harness-node 0.3.0 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,52 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.5.0 locale=en baseline=sha256:03eca87a8c9bea814e741518168696f17c869bdb71baf2046cef4c3596d9ebf3 -->
+## [0.5.0] - 2026-08-16
+
+This release adds the declared read surface assertion (FND-ADR-010) and the structured surface scanner (FND-ADR-011) to the stable Harness surface, growing HARNESS_CAPABILITIES from 16 to 18 entries, and adds three dependency-reviewed runtime libraries.
+
+### Added
+
+- Adds assertDeclaredReadSurface (FND-ADR-010): a no-execution, syntax-surface-only assertion that every node:fs named import inside a declared module set stays inside the consumer-declared read surface, with a closed violation vocabulary and a frozen declared-read-surface-result envelope.
+- Adds scanSurfaceStructured (FND-ADR-011): the structured sibling of scanSurface. IP-shaped candidates enter a single standard parse entry (ipaddr.js) with consumer-declared CIDR approval and fail closed when unparseable; scoped and unscoped coordinates, registries and hosts need consumer-declared approval; format adapters (pnpm-lockfile via @pnpm/lockfile.fs with yaml AST comment regions, and tree-json) parse structurally with no position-level exemptions; binary and symlink policies fail closed. The closed nine-rule vocabulary travels in details.rule of the structured-scan-violation mechanism error.
+- Adds three dependency-reviewed runtime libraries for the structured scanner, reviewed per FND-ADR-006 section-4 analogy (dependency-closure pre-review, executor self-review pending independent review): ipaddr.js 2.5.0 (MIT, zero dependencies), yaml 2.9.0 (ISC), and @pnpm/lockfile.fs 1001.1.35 (MIT, 18 transitive dependencies all inside the approved public coordinates).
+- Grows HARNESS_CAPABILITIES from 16 to 18 entries for the two new mechanisms.
+
+### Changed
+
+- Documents the relationship of the two policy documents to workspace-private leak policies: a workspace-private leak-policy.json instance document is not a subset, not isomorphic and not a migration target of the surface-scan-policy or structured-scan-policy schemas — the documents share rule vocabulary and fail-closed semantics by design, but their byte-level shapes are independent and must not be compared for compatibility. scanSurface is the execution-core generalization projection: the public, consumer-parameterized form of the same mechanism family, without any private identity, path, or approval-list interpretation of its own.
+- Records the cost of the dependency-review decision honestly: the harness tarball grows with the @pnpm/lockfile.fs closure, the thin-runtime property changes from zero third-party runtime dependencies to three reviewed ones, and the pnpm-lockfile adapter writes one temporary lockfile copy under the OS temp directory (removed afterwards). The engineering-kit offline-consumer verification gates now derive the complete third-party production closure of the three Foundation packages mechanically (identity-deduplicated, npm: alias-aware, range-scoped override selectors) instead of a single-package closure, so the review decision is continuously verified against the real installed bytes.
+- Keeps mechanism purity: no execution of scanned files, no model calls, no network; symlinked entries are never followed.
+
+### Upgrade Notes
+
+Version 0.5.0 is the FND-ADR-010/011 harness line. Mechanism imports use the stable capability names published in HARNESS_CAPABILITIES; structured-scan policies must pass the structured-scan-policy contract validation of contract-spec 1.5.0.
+<!-- release-skill:changelog:end version=0.5.0 locale=en -->
+
+
+<!-- release-skill:changelog:start version=0.4.0 locale=en baseline=sha256:72d3fe048ced8eb44a84fabe6f1fdd2eb0c938b4f6bb98740474f72aec04d873 -->
+## [0.4.0] - 2026-08-16
+
+This release adds five finite-closed-semantics mechanisms and a token-lock primitive to the stable Harness surface (FND-ADR-009), grows HARNESS_CAPABILITIES from 9 to 16 entries, and ships the rename-directory-no-replace native-prebuild candidate.
+
+### Added
+
+- Adds five finite-closed-semantics mechanisms (FND-ADR-009), namely frozen-baseline materialization with contentGuard, the generic read chokepoint, strategy-driven surface scanning, deterministic token upper-bound estimation, and the generic upper-bound guard.
+- Adds the token-lock primitive for exclusive token-file publication and digest verification.
+- Grows HARNESS_CAPABILITIES from 9 to 16 entries for the new mechanisms.
+- Adds the rename-directory-no-replace candidate, a native-prebuild addon proving no-replace directory renames on darwin-arm64, darwin-x64, linux-arm64-gnu, and linux-x64-gnu, with a release receipt and SBOM.
+
+### Changed
+
+- Keeps the Quickstart Profile v2 Task/Result exchange verification delivered in 0.3.0, including real-byte recomputation for path-backed outputs and evidence, duplicate Resource id rejection, and exact evidence binding verification.
+- Leaves method selection, retry policy, and domain result interpretation to the consumer.
+
+### Upgrade Notes
+
+Version 0.4.0 is released on npm and the public mirror. Pin the candidate subpath to exactly 0.4.0; mechanism imports use the stable capability names published in HARNESS_CAPABILITIES.
+<!-- release-skill:changelog:end version=0.4.0 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.3.0 locale=en baseline=sha256:7afef97792b4714abbd0412dcb7ea76ca66260ef9f8dd2191131b7c3f8539813 -->
 ## [0.3.0] - 2026-08-12
 

package/CHANGELOG.zh-CN.md

@@ -1,5 +1,52 @@
 # 变更日志
 
+<!-- release-skill:changelog:start version=0.5.0 locale=zh-CN baseline=sha256:003472359596147fe26ad2ba53a82303a217c28cb89a6afacdaa955793001f71 -->
+## [0.5.0] - 2026-08-16
+
+本版在稳定 Harness 面上新增声明读取表面断言（FND-ADR-010）与结构化表面扫描器（FND-ADR-011），HARNESS_CAPABILITIES 从 16 项增至 18 项，并引入三个经依赖评审的运行时库。
+
+### 新增
+
+- 新增 assertDeclaredReadSurface（FND-ADR-010）：不执行、仅语法面的断言，声明模块集内的每个 node:fs 具名导入必须落在消费者声明的读取表面内，违规词汇表为闭集，返回冻结的 declared-read-surface-result 信封。
+- 新增 scanSurfaceStructured（FND-ADR-011）：scanSurface 的结构化兄弟。IP 形候选统一进入单一标准解析入口（ipaddr.js），按消费者声明的 CIDR 批准，不可解析即失败关闭；坐标（scoped 与非 scoped）、注册表与主机均需消费者声明批准；格式适配器（pnpm-lockfile 经 @pnpm/lockfile.fs + yaml AST 注释区域，tree-json 经 JSON.parse）结构化解析且无位置级豁免；二进制与符号链接策略失败关闭。闭集九规则词汇表经 structured-scan-violation 机制错误的 details.rule 承载。
+- 为结构化扫描器引入三个经依赖评审的运行时库，评审按 FND-ADR-006 第 4 节类比执行（依赖闭包预审，执行者自审，独立复核另行安排）：ipaddr.js 2.5.0（MIT，零依赖）、yaml 2.9.0（ISC）、@pnpm/lockfile.fs 1001.1.35（MIT，18 个传递依赖全部在批准公共坐标内）。
+- HARNESS_CAPABILITIES 从 16 项增至 18 项，覆盖两个新机制。
+
+### 变更
+
+- 显式说明两个策略文档与工作区私有 leak 策略的关系：工作区私有的 leak-policy.json 实例文档既不是 surface-scan-policy 或 structured-scan-policy schema 的子集、也不同构、更不是迁移目标——两类文档按设计共享规则词汇与失败关闭语义，但字节级形状相互独立，不得比较兼容性。scanSurface 是执行内核通用化投影：同一机制族的公开、消费者参数化形态，自身不解释任何私有身份、路径或批准清单。
+- 如实记录依赖评审决策的成本：harness tarball 随 @pnpm/lockfile.fs 闭包扩大；薄运行时属性从零第三方运行时依赖变为三个经评审依赖；pnpm-lockfile 适配器会在 OS 临时目录写一份临时锁文件副本（用后即删）。engineering-kit 的离线消费者验证门随之把第三方闭包推导从单包闭包机械扩展为三个 Foundation 包的完整生产闭包（真实身份去重、npm: 别名感知、range-scoped override selector），使评审决策持续对着真实安装字节被验证。
+- 保持机制纯度：不执行被扫描文件、无模型调用、无网络；永不跟随符号链接。
+
+### 升级说明
+
+0.5.0 是 FND-ADR-010/011 harness 线。机制导入使用 HARNESS_CAPABILITIES 公布的稳定能力名；structured-scan 策略必须通过契约规格 1.5.0 的 structured-scan-policy 契约校验。
+<!-- release-skill:changelog:end version=0.5.0 locale=zh-CN -->
+
+
+<!-- release-skill:changelog:start version=0.4.0 locale=zh-CN baseline=sha256:dafaa1100bf6163a28d53fc982a30e8325d8bd3cab43bbb6daf2e6002befa2c1 -->
+## [0.4.0] - 2026-08-16
+
+本版在稳定 Harness 面上新增五项有限封闭语义机制与 token-lock 原语（FND-ADR-009），HARNESS_CAPABILITIES 从 9 项增至 16 项，并随附 rename-directory-no-replace 原生预编译候选。
+
+### 新增
+
+- 新增五项有限封闭语义机制（FND-ADR-009）：冻结基线物化 + contentGuard、通用只读 chokepoint、策略化表面扫描、确定性 token 上界估算与通用上限守卫。
+- 新增 token-lock 原语：独占 token 文件发布与摘要复验。
+- HARNESS_CAPABILITIES 从 9 项增至 16 项，覆盖上述新机制。
+- 新增 rename-directory-no-replace 候选：覆盖 darwin-arm64、darwin-x64、linux-arm64-gnu、linux-x64-gnu 的原生预编译 no-replace 目录改名 addon，附带发布 receipt 与 SBOM。
+
+### 变更
+
+- 保持 0.3.0 交付的 Quickstart Profile v2 Task/Result 交换校验：path-backed output 与 evidence 重算真实字节、拒绝重复 Resource id、evidence 精确绑定逐项复验。
+- 方法选择、重试策略与领域结果解释继续归消费者所有。
+
+### 升级说明
+
+0.4.0 已发布到 npm 与 public 镜像仓。candidate 子路径必须精确锁定 0.4.0；机制导入使用 HARNESS_CAPABILITIES 公布的稳定能力名。
+<!-- release-skill:changelog:end version=0.4.0 locale=zh-CN -->
+
+
 <!-- release-skill:changelog:start version=0.3.0 locale=zh-CN baseline=sha256:b635e4170d3f7ac634e59f612939683ab04727f87101790d9a9f5613ea38fcfe -->
 ## [0.3.0] - 2026-08-12
 

package/README.md

@@ -4,28 +4,31 @@
 
 # skill-family-harness-node
 
-<!-- release-skill:release-version: 0.3.0 -->
+<!-- release-skill:release-version: 0.5.0 -->
 
 The **single default Node implementation** of the Contracts mechanism protocol. This is a thin runtime: it only implements the mechanism protocol, introduces no business semantics, and does not provide a second-language implementation.
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.3.0** (2026-08-12)
+**0.5.0** (2026-08-16)
 
-This source candidate updates the Quickstart Profile harness to verify v2 Task and Result exchanges without taking ownership of consumer semantics.
+This release adds the declared read surface assertion (FND-ADR-010) and the structured surface scanner (FND-ADR-011) to the stable Harness surface, growing HARNESS_CAPABILITIES from 16 to 18 entries, and adds three dependency-reviewed runtime libraries.
 
 **Added**
 
-- Recomputes real bytes for path-backed outputs and evidence, and rejects duplicate Resource ids across observations, outputs, and evidence.
-- Verifies operation identity, Task digest, every run/stage/attempt field, and the exact evidence binding set.
+- Adds assertDeclaredReadSurface (FND-ADR-010): a no-execution, syntax-surface-only assertion that every node:fs named import inside a declared module set stays inside the consumer-declared read surface, with a closed violation vocabulary and a frozen declared-read-surface-result envelope.
+- Adds scanSurfaceStructured (FND-ADR-011): the structured sibling of scanSurface. IP-shaped candidates enter a single standard parse entry (ipaddr.js) with consumer-declared CIDR approval and fail closed when unparseable; scoped and unscoped coordinates, registries and hosts need consumer-declared approval; format adapters (pnpm-lockfile via @pnpm/lockfile.fs with yaml AST comment regions, and tree-json) parse structurally with no position-level exemptions; binary and symlink policies fail closed. The closed nine-rule vocabulary travels in details.rule of the structured-scan-violation mechanism error.
+- Adds three dependency-reviewed runtime libraries for the structured scanner, reviewed per FND-ADR-006 section-4 analogy (dependency-closure pre-review, executor self-review pending independent review): ipaddr.js 2.5.0 (MIT, zero dependencies), yaml 2.9.0 (ISC), and @pnpm/lockfile.fs 1001.1.35 (MIT, 18 transitive dependencies all inside the approved public coordinates).
+- Grows HARNESS_CAPABILITIES from 16 to 18 entries for the two new mechanisms.
 
 **Changed**
 
-- Replaces the incompatible 0.2.1 candidate surface; consumers that still require v1 must remain pinned to exactly 0.2.1.
-- Leaves method selection, retry policy, and domain result interpretation to the consumer.
+- Documents the relationship of the two policy documents to workspace-private leak policies: a workspace-private leak-policy.json instance document is not a subset, not isomorphic and not a migration target of the surface-scan-policy or structured-scan-policy schemas — the documents share rule vocabulary and fail-closed semantics by design, but their byte-level shapes are independent and must not be compared for compatibility. scanSurface is the execution-core generalization projection: the public, consumer-parameterized form of the same mechanism family, without any private identity, path, or approval-list interpretation of its own.
+- Records the cost of the dependency-review decision honestly: the harness tarball grows with the @pnpm/lockfile.fs closure, the thin-runtime property changes from zero third-party runtime dependencies to three reviewed ones, and the pnpm-lockfile adapter writes one temporary lockfile copy under the OS temp directory (removed afterwards). The engineering-kit offline-consumer verification gates now derive the complete third-party production closure of the three Foundation packages mechanically (identity-deduplicated, npm: alias-aware, range-scoped override selectors) instead of a single-package closure, so the review decision is continuously verified against the real installed bytes.
+- Keeps mechanism purity: no execution of scanned files, no model calls, no network; symlinked entries are never followed.
 
 **Upgrade Notes**
 
-Version 0.3.0 is a local, unpublished source candidate. Pin the candidate subpath to an exact package version and update v1 exchange producers before adopting it.
+Version 0.5.0 is the FND-ADR-010/011 harness line. Mechanism imports use the stable capability names published in HARNESS_CAPABILITIES; structured-scan policies must pass the structured-scan-policy contract validation of contract-spec 1.5.0.
 <!-- release-skill:managed:end id=latest-release -->
 
 ## Problem It Solves
@@ -39,14 +42,14 @@ The Harness consumes `skill-family-contracts` (a workspace dependency), reusing
 ## Installation and Minimal Example
 
 ```sh
-npm install skill-family-harness-node@0.3.0
+npm install skill-family-harness-node@0.5.0
 npm info skill-family-harness-node --help
 ```
 
 The minimal example shows validating a contract document inside Node:
 
 ```js
-// Run from an empty directory: npm install skill-family-harness-node@0.3.0
+// Run from an empty directory: npm install skill-family-harness-node@0.5.0
 import { validateContractDocument } from "skill-family-harness-node";
 
 const document = {
@@ -80,7 +83,7 @@ import {
 
 The v2 mechanism recomputes the bytes of every path-backed output and evidence Resource. It also rejects duplicate Resource ids, correlation drift, a changed Task digest, and incomplete or mismatched evidence bindings. It does not perform a domain audit, choose a method, retry work, or own lifecycle state.
 
-The subpath is public but **not stable** and may change or be removed in a later minor release. Pin exactly `0.3.0` for v2; integrations that still produce candidate v1 exchanges must stay pinned to exactly `0.2.1`.
+The subpath is public but **not stable** and may change or be removed in a later minor release. Pin exactly `0.4.0` for v2; integrations that still produce candidate v1 exchanges must stay pinned to exactly `0.2.1`.
 
 ## Typical Use Cases
 

package/README.zh-CN.md

@@ -5,28 +5,31 @@
 
 # skill-family-harness-node
 
-<!-- release-skill:release-version: 0.3.0 -->
+<!-- release-skill:release-version: 0.5.0 -->
 
 Contracts 机制协议的**唯一默认 Node 实现**。这是一个薄运行时（thin runtime）：只实现机制协议，不引入业务语义，不做第二语言实现。
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.3.0** (2026-08-12)
+**0.5.0** (2026-08-16)
 
-本源码候选版把 Quickstart Profile Harness 更新为 v2 Task/Result 交换校验，同时不接管消费者语义。
+本版在稳定 Harness 面上新增声明读取表面断言（FND-ADR-010）与结构化表面扫描器（FND-ADR-011），HARNESS_CAPABILITIES 从 16 项增至 18 项，并引入三个经依赖评审的运行时库。
 
 **新增**
 
-- 对 path-backed output 与 evidence 重算真实字节摘要，并拒绝 observation、output、evidence 之间重复的 Resource id。
-- 逐项复验 operation 身份、Task digest、run/stage/attempt 字段和 evidence 精确绑定集合。
+- 新增 assertDeclaredReadSurface（FND-ADR-010）：不执行、仅语法面的断言，声明模块集内的每个 node:fs 具名导入必须落在消费者声明的读取表面内，违规词汇表为闭集，返回冻结的 declared-read-surface-result 信封。
+- 新增 scanSurfaceStructured（FND-ADR-011）：scanSurface 的结构化兄弟。IP 形候选统一进入单一标准解析入口（ipaddr.js），按消费者声明的 CIDR 批准，不可解析即失败关闭；坐标（scoped 与非 scoped）、注册表与主机均需消费者声明批准；格式适配器（pnpm-lockfile 经 @pnpm/lockfile.fs + yaml AST 注释区域，tree-json 经 JSON.parse）结构化解析且无位置级豁免；二进制与符号链接策略失败关闭。闭集九规则词汇表经 structured-scan-violation 机制错误的 details.rule 承载。
+- 为结构化扫描器引入三个经依赖评审的运行时库，评审按 FND-ADR-006 第 4 节类比执行（依赖闭包预审，执行者自审，独立复核另行安排）：ipaddr.js 2.5.0（MIT，零依赖）、yaml 2.9.0（ISC）、@pnpm/lockfile.fs 1001.1.35（MIT，18 个传递依赖全部在批准公共坐标内）。
+- HARNESS_CAPABILITIES 从 16 项增至 18 项，覆盖两个新机制。
 
 **变更**
 
-- 替换与 0.2.1 不兼容的 candidate 面；仍依赖 v1 的消费者必须继续精确锁定 0.2.1。
-- 方法选择、重试策略与领域结果解释继续归消费者所有。
+- 显式说明两个策略文档与工作区私有 leak 策略的关系：工作区私有的 leak-policy.json 实例文档既不是 surface-scan-policy 或 structured-scan-policy schema 的子集、也不同构、更不是迁移目标——两类文档按设计共享规则词汇与失败关闭语义，但字节级形状相互独立，不得比较兼容性。scanSurface 是执行内核通用化投影：同一机制族的公开、消费者参数化形态，自身不解释任何私有身份、路径或批准清单。
+- 如实记录依赖评审决策的成本：harness tarball 随 @pnpm/lockfile.fs 闭包扩大；薄运行时属性从零第三方运行时依赖变为三个经评审依赖；pnpm-lockfile 适配器会在 OS 临时目录写一份临时锁文件副本（用后即删）。engineering-kit 的离线消费者验证门随之把第三方闭包推导从单包闭包机械扩展为三个 Foundation 包的完整生产闭包（真实身份去重、npm: 别名感知、range-scoped override selector），使评审决策持续对着真实安装字节被验证。
+- 保持机制纯度：不执行被扫描文件、无模型调用、无网络；永不跟随符号链接。
 
 **升级说明**
 
-0.3.0 当前只是本地、未发布的源码候选。candidate 子路径必须精确锁定包版本，采用前需更新 v1 交换生产方。
+0.5.0 是 FND-ADR-010/011 harness 线。机制导入使用 HARNESS_CAPABILITIES 公布的稳定能力名；structured-scan 策略必须通过契约规格 1.5.0 的 structured-scan-policy 契约校验。
 <!-- release-skill:managed:end id=latest-release -->
 
 ## 解决的问题
@@ -40,14 +43,14 @@ Harness 消费 `skill-family-contracts`（工作区依赖），复用其方言
 ## 安装和最小示例
 
 ```sh
-npm install skill-family-harness-node@0.3.0
+npm install skill-family-harness-node@0.5.0
 npm info skill-family-harness-node --help
 ```
 
 最小示例演示在 Node 内校验一份契约文档：
 
 ```js
-// 从空目录运行：npm install skill-family-harness-node@0.3.0
+// 从空目录运行：npm install skill-family-harness-node@0.5.0
 import { validateContractDocument } from "skill-family-harness-node";
 
 const document = {
@@ -81,7 +84,7 @@ import {
 
 v2 机制会重算每个 path-backed output 和 evidence Resource 的真实字节摘要，并拒绝重复 Resource id、correlation 漂移、Task digest 变化，以及缺失或错配的 evidence binding。它不执行领域审计，不选择 method，不编排重试，也不拥有生命周期状态。
 
-该子路径公开但**不稳定**，后续小版本可以修改或移除。使用 v2 时应精确锁定 `0.3.0`；仍生产 candidate v1 交换的接入必须继续精确锁定 `0.2.1`。
+该子路径公开但**不稳定**，后续小版本可以修改或移除。使用 v2 时应精确锁定 `0.4.0`；仍生产 candidate v1 交换的接入必须继续精确锁定 `0.2.1`。
 
 ## 典型使用场景
 

package/candidate/mechanisms-cli.mjs

@@ -1,41 +1,157 @@
 #!/usr/bin/env node
 import { stdin, stdout, stderr } from "node:process";
+import { realpathSync } from "node:fs";
+import { fileURLToPath } from "node:url";
 import {
-  canonicalJson,
-  computeResourceClosure,
-  digestDocument,
+  invokeFoundationMechanism,
+  verifyManagedBundleIdentity,
 } from "./quickstart-profile.mjs";
 
-async function readRequest() {
+const CLI_NAME = "mechanisms-cli.mjs";
+
+async function readRequest(input) {
   const chunks = [];
-  for await (const chunk of stdin) chunks.push(chunk);
-  return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+  for await (const chunk of input) chunks.push(Buffer.from(chunk));
+  const text = new TextDecoder("utf-8", { fatal: true }).decode(Buffer.concat(chunks));
+  return JSON.parse(text);
+}
+
+function errorResponse(cause) {
+  return {
+    ok: false,
+    error: {
+      name: typeof cause?.name === "string" ? cause.name : "Error",
+      message: cause?.message ?? String(cause),
+    },
+  };
 }
 
-export async function runMechanismCli() {
+/**
+ * Fixed dispatch for the publish-fixed-set operation.
+ *
+ * This operation is fail-closed: if the native addon is unavailable or the
+ * platform is unsupported, the operation returns a receipt with status=refused
+ * and error code UNSUPPORTED_PLATFORM. No JS rename fallback is attempted.
+ *
+ * The operation takes a frozen sibling-directory source/target tuple and
+ * returns a receipt. It does NOT
+ * expose any module/function/pathToFileURL call surface.
+ */
+async function runPublishFixedSet(params, invoke) {
+  if (
+    params === null ||
+    typeof params !== "object" ||
+    Array.isArray(params) ||
+    Object.keys(params).sort().join(",") !== "manifest,sourceRoot,targetParent,targetSegment" ||
+    typeof params.sourceRoot !== "string" ||
+    typeof params.targetParent !== "string" ||
+    typeof params.targetSegment !== "string" ||
+    params.manifest === null ||
+    typeof params.manifest !== "object"
+  ) {
+    throw new TypeError("publish-fixed-set requires exactly sourceRoot, targetParent, targetSegment, and manifest");
+  }
+
+  let publishFixedSet;
   try {
-    const request = await readRequest();
+    const mod = await import("./rename-directory-no-replace/rename-directory-no-replace.mjs");
+    publishFixedSet = mod.publishFixedSet;
+  } catch (cause) {
+    const manifestDigest = await invoke({ operation: "digest-document", params: { document: params.manifest } });
+    return {
+      schemaVersion: 1,
+      kind: "skill-family.fixed-set-publication-receipt",
+      manifestDigest: manifestDigest.digest,
+      targetRootBinding: params.manifest?.target?.rootBinding ?? {
+        kind: "trusted-filesystem-root-binding", digestAlgorithm: "sha256",
+        basis: "canonical-realpath-device-inode-type-mode-v1", digest: "0".repeat(64),
+      },
+      platform: "other",
+      primitive: "none",
+      status: "refused",
+      targetState: "absent",
+      commitState: "not-committed",
+      verification: "not-run",
+      durability: "not-attempted",
+      error: {
+        code: "UNSUPPORTED_PLATFORM",
+        message: `publish-fixed-set module unavailable: ${cause?.message ?? "unknown"}`.slice(0, 300),
+      },
+    };
+  }
+
+  return publishFixedSet(params);
+}
+
+/** Fixed manifest construction for the same receipt-bound publication mechanism. */
+async function runCreateFixedSetPublicationManifest(params) {
+  if (
+    params === null ||
+    typeof params !== "object" ||
+    Array.isArray(params) ||
+    Object.keys(params).sort().join(",") !== "sourceRoot,targetParent,targetSegment" ||
+    typeof params.sourceRoot !== "string" ||
+    typeof params.targetParent !== "string" ||
+    typeof params.targetSegment !== "string"
+  ) {
+    throw new TypeError(
+      "create-fixed-set-publication-manifest requires exactly sourceRoot, targetParent, and targetSegment",
+    );
+  }
+  const { createFixedSetPublicationManifest } = await import(
+    "./rename-directory-no-replace/rename-directory-no-replace.mjs"
+  );
+  return createFixedSetPublicationManifest(params);
+}
+
+/**
+ * One-request/one-response JSON transport for the fixed Foundation mechanism
+ * bridge. The offline Bundle rewrites the import above to its managed runner,
+ * which injects the Bundle-owned schema validator. No request can name a
+ * module, export, or arbitrary function.
+ */
+export async function runMechanismCli({
+  input = stdin,
+  output = stdout,
+  error = stderr,
+  invoke = invokeFoundationMechanism,
+} = {}) {
+  try {
+    const request = await readRequest(input);
     let result;
-    if (request.operation === "canonical-json") {
-      result = { text: canonicalJson(request.document) };
-    } else if (request.operation === "digest-document") {
-      result = { digest: digestDocument(request.document) };
-    } else if (request.operation === "resource-closure") {
-      result = await computeResourceClosure({
-        root: request.root,
-        resources: request.resources,
-      });
+    if (request?.operation === "self-check") {
+      result = await runSelfCheck(request);
+    } else if (request?.operation === "create-fixed-set-publication-manifest") {
+      result = await runCreateFixedSetPublicationManifest(request.params);
+    } else if (request?.operation === "publish-fixed-set") {
+      result = await runPublishFixedSet(request.params, invoke);
     } else {
-      throw new TypeError(`unknown Foundation mechanism: ${String(request.operation)}`);
+      result = await invoke(request);
     }
-    stdout.write(`${JSON.stringify(result)}\n`);
+    output.write(`${JSON.stringify(result)}\n`);
     return 0;
   } catch (cause) {
-    stderr.write(`${cause?.message ?? String(cause)}\n`);
+    error.write(`${JSON.stringify(errorResponse(cause))}\n`);
     return 2;
   }
 }
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+async function runSelfCheck(request) {
+  if (
+    request === null ||
+    typeof request !== "object" ||
+    Array.isArray(request) ||
+    Object.keys(request).sort().join(",") !== "operation,params" ||
+    request.params === null ||
+    typeof request.params !== "object" ||
+    Array.isArray(request.params) ||
+    Object.keys(request.params).length !== 0
+  ) {
+    throw new TypeError("mechanisms CLI self-check requires exactly operation and empty params");
+  }
+  return verifyManagedBundleIdentity({ cliUrl: import.meta.url, cliName: CLI_NAME });
+}
+
+if (process.argv[1] && realpathSync(fileURLToPath(import.meta.url)) === realpathSync(process.argv[1])) {
   process.exitCode = await runMechanismCli();
 }