skill-family-harness-node 0.4.0 → 0.6.0

package/CHANGELOG.md

@@ -1,5 +1,53 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.6.0 locale=en baseline=sha256:c67e713aebe53382c651655a2be9e78ace8da6a1b7852c1e6acadcb383ff2422 -->
+## [0.6.0] - 2026-08-21
+
+This release adds bounded subprocess supervision (FND-ADR-012), completes the Foundation strict authority read path with contained nested directory preparation (FG-1), adds pre-persistence URL credential redaction (FG-2), and grows HARNESS_CAPABILITIES from 18 to 21.
+
+### Added
+
+- Adds superviseProcess with validateTimeoutPolicy, WATCHDOG_REASONS, TERMINATION_REASONS, PROCESS_STATUSES and ENVELOPE_GUARANTEES (FND-ADR-012) - one bounded spawn, liveness by explicit events, consumer-supplied timeout policy, SIGTERM then grace then SIGKILL against the process group, and a single closed-enum termination envelope; the mechanism never restarts the supervised process and never holds timeout values.
+- Adds readFileStrict (FG-1), the read-side twin of the strict write path - containment first, symlink refusal with O_NOFOLLOW, regular-file identity re-assertion on the opened handle (dev/ino), and a sha256 digest receipt of the exact bytes read; an optional expectedSha256 content guard fails closed before any delivery.
+- Adds the createParents option to publishFileExclusive (FG-1) - the missing portion of the parent chain is prepared as real directories inside the containment layer and every intermediate entry is re-verified as a real directory; symlink components are still refused and no entry is ever replaced.
+- Adds redactUrlCredentials with REDACTED_URL_PLACEHOLDER (FG-2) - strips the userinfo component from any URL before the value reaches disk or logs; unparseable input degrades to an opaque placeholder and never leaks to the output.
+- Re-exports the contracts-owned token estimate consumption contract (consumeTokenEstimate, consumeTokenEstimateStrict and companions) next to estimateTokens, and carries the authoritative token estimator estimateTokens with the skill-family-token-estimate CLI (audit remediation C1).
+
+### Changed
+
+- Grows HARNESS_CAPABILITIES from 18 to 21 (adds supervise-process, strict-read and url-credential-redaction); the strict write path keeps its no-replace, byte-verified receipt semantics unchanged.
+- Keeps business semantics, retry/restart policy, budget thresholds, and the decision of which values are URLs under consumer ownership; the harness owns mechanism only.
+
+### Upgrade Notes
+
+Version 0.6.0 is the Foundation capability completion line. The createParents option of publishFileExclusive is a Foundation-side profile behavior change under the 2026-08-19 discipline; consumers needing contained nested publication must pin exactly 0.6.0.
+<!-- release-skill:changelog:end version=0.6.0 locale=en -->
+
+
+<!-- release-skill:changelog:start version=0.5.0 locale=en baseline=sha256:03eca87a8c9bea814e741518168696f17c869bdb71baf2046cef4c3596d9ebf3 -->
+## [0.5.0] - 2026-08-16
+
+This release adds the declared read surface assertion (FND-ADR-010) and the structured surface scanner (FND-ADR-011) to the stable Harness surface, growing HARNESS_CAPABILITIES from 16 to 18 entries, and adds three dependency-reviewed runtime libraries.
+
+### Added
+
+- Adds assertDeclaredReadSurface (FND-ADR-010): a no-execution, syntax-surface-only assertion that every node:fs named import inside a declared module set stays inside the consumer-declared read surface, with a closed violation vocabulary and a frozen declared-read-surface-result envelope.
+- Adds scanSurfaceStructured (FND-ADR-011): the structured sibling of scanSurface. IP-shaped candidates enter a single standard parse entry (ipaddr.js) with consumer-declared CIDR approval and fail closed when unparseable; scoped and unscoped coordinates, registries and hosts need consumer-declared approval; format adapters (pnpm-lockfile via @pnpm/lockfile.fs with yaml AST comment regions, and tree-json) parse structurally with no position-level exemptions; binary and symlink policies fail closed. The closed nine-rule vocabulary travels in details.rule of the structured-scan-violation mechanism error.
+- Adds three dependency-reviewed runtime libraries for the structured scanner, reviewed per FND-ADR-006 section-4 analogy (dependency-closure pre-review, executor self-review pending independent review): ipaddr.js 2.5.0 (MIT, zero dependencies), yaml 2.9.0 (ISC), and @pnpm/lockfile.fs 1001.1.35 (MIT, 18 transitive dependencies all inside the approved public coordinates).
+- Grows HARNESS_CAPABILITIES from 16 to 18 entries for the two new mechanisms.
+
+### Changed
+
+- Documents the relationship of the two policy documents to workspace-private leak policies: a workspace-private leak-policy.json instance document is not a subset, not isomorphic and not a migration target of the surface-scan-policy or structured-scan-policy schemas — the documents share rule vocabulary and fail-closed semantics by design, but their byte-level shapes are independent and must not be compared for compatibility. scanSurface is the execution-core generalization projection: the public, consumer-parameterized form of the same mechanism family, without any private identity, path, or approval-list interpretation of its own.
+- Records the cost of the dependency-review decision honestly: the harness tarball grows with the @pnpm/lockfile.fs closure, the thin-runtime property changes from zero third-party runtime dependencies to three reviewed ones, and the pnpm-lockfile adapter writes one temporary lockfile copy under the OS temp directory (removed afterwards). The engineering-kit offline-consumer verification gates now derive the complete third-party production closure of the three Foundation packages mechanically (identity-deduplicated, npm: alias-aware, range-scoped override selectors) instead of a single-package closure, so the review decision is continuously verified against the real installed bytes.
+- Keeps mechanism purity: no execution of scanned files, no model calls, no network; symlinked entries are never followed.
+
+### Upgrade Notes
+
+Version 0.5.0 is the FND-ADR-010/011 harness line. Mechanism imports use the stable capability names published in HARNESS_CAPABILITIES; structured-scan policies must pass the structured-scan-policy contract validation of contract-spec 1.5.0.
+<!-- release-skill:changelog:end version=0.5.0 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.4.0 locale=en baseline=sha256:72d3fe048ced8eb44a84fabe6f1fdd2eb0c938b4f6bb98740474f72aec04d873 -->
 ## [0.4.0] - 2026-08-16
 

package/CHANGELOG.zh-CN.md

@@ -1,5 +1,53 @@
 # 变更日志
 
+<!-- release-skill:changelog:start version=0.6.0 locale=zh-CN baseline=sha256:6a4a94f692909faf2090445638988b27841a8bca67a85fd7812864d656299175 -->
+## [0.6.0] - 2026-08-21
+
+本版新增有界子进程监督（FND-ADR-012），补齐 Foundation 严格权威读取路径与受收容嵌套目录准备（FG-1），新增落盘前 URL 凭证脱敏（FG-2），HARNESS_CAPABILITIES 从 18 项增至 21 项。
+
+### 新增
+
+- 新增 superviseProcess 与 validateTimeoutPolicy、WATCHDOG_REASONS、TERMINATION_REASONS、PROCESS_STATUSES、ENVELOPE_GUARANTEES（FND-ADR-012）：单次有界 spawn、显式事件判活、消费者提供的超时策略、对进程组 SIGTERM→宽限→SIGKILL、单一闭集枚举终止信封；机制从不重启被监督进程，也从不持有超时数值。
+- 新增 readFileStrict（FG-1）：严格写入路径的读取孪生体——先收容、拒绝符号链接（O_NOFOLLOW）、在已打开句柄上复核常规文件身份（dev/ino），并返回所读精确字节的 sha256 摘要回执；可选 expectedSha256 内容守卫在任何交付前失败关闭。
+- publishFileExclusive 新增 createParents 选项（FG-1）：父目录链缺失部分在收容层内准备为真实目录，每个中间条目都复核为真实目录；符号链接组件仍被拒绝，任何条目都不被替换。
+- 新增 redactUrlCredentials 与 REDACTED_URL_PLACEHOLDER（FG-2）：任何 URL 的 userinfo 部分在数值到达磁盘或日志前剥离；不可解析输入退化为不透明占位符，绝不泄漏到输出。
+- 在 estimateTokens 旁转导出 contracts 拥有的 token 估算消费合同（consumeTokenEstimate、consumeTokenEstimateStrict 及伴生常量），并承载权威词元估算器 estimateTokens 与 skill-family-token-estimate CLI（审计整改 C1）。
+
+### 变更
+
+- HARNESS_CAPABILITIES 从 18 项增至 21 项（新增 supervise-process、strict-read、url-credential-redaction）；严格写入路径的不替换、字节验证回执语义保持不变。
+- 业务语义、重试/重启策略、预算阈值与「哪些值是 URL」的判定继续归消费者所有；harness 只拥有机制。
+
+### 升级说明
+
+0.6.0 是 Foundation 能力补齐线。publishFileExclusive 的 createParents 选项是按 2026-08-19 纪律的 Foundation 侧 profile 行为变更；需要受收容嵌套发布的消费者必须精确锁定 0.6.0。
+<!-- release-skill:changelog:end version=0.6.0 locale=zh-CN -->
+
+
+<!-- release-skill:changelog:start version=0.5.0 locale=zh-CN baseline=sha256:003472359596147fe26ad2ba53a82303a217c28cb89a6afacdaa955793001f71 -->
+## [0.5.0] - 2026-08-16
+
+本版在稳定 Harness 面上新增声明读取表面断言（FND-ADR-010）与结构化表面扫描器（FND-ADR-011），HARNESS_CAPABILITIES 从 16 项增至 18 项，并引入三个经依赖评审的运行时库。
+
+### 新增
+
+- 新增 assertDeclaredReadSurface（FND-ADR-010）：不执行、仅语法面的断言，声明模块集内的每个 node:fs 具名导入必须落在消费者声明的读取表面内，违规词汇表为闭集，返回冻结的 declared-read-surface-result 信封。
+- 新增 scanSurfaceStructured（FND-ADR-011）：scanSurface 的结构化兄弟。IP 形候选统一进入单一标准解析入口（ipaddr.js），按消费者声明的 CIDR 批准，不可解析即失败关闭；坐标（scoped 与非 scoped）、注册表与主机均需消费者声明批准；格式适配器（pnpm-lockfile 经 @pnpm/lockfile.fs + yaml AST 注释区域，tree-json 经 JSON.parse）结构化解析且无位置级豁免；二进制与符号链接策略失败关闭。闭集九规则词汇表经 structured-scan-violation 机制错误的 details.rule 承载。
+- 为结构化扫描器引入三个经依赖评审的运行时库，评审按 FND-ADR-006 第 4 节类比执行（依赖闭包预审，执行者自审，独立复核另行安排）：ipaddr.js 2.5.0（MIT，零依赖）、yaml 2.9.0（ISC）、@pnpm/lockfile.fs 1001.1.35（MIT，18 个传递依赖全部在批准公共坐标内）。
+- HARNESS_CAPABILITIES 从 16 项增至 18 项，覆盖两个新机制。
+
+### 变更
+
+- 显式说明两个策略文档与工作区私有 leak 策略的关系：工作区私有的 leak-policy.json 实例文档既不是 surface-scan-policy 或 structured-scan-policy schema 的子集、也不同构、更不是迁移目标——两类文档按设计共享规则词汇与失败关闭语义，但字节级形状相互独立，不得比较兼容性。scanSurface 是执行内核通用化投影：同一机制族的公开、消费者参数化形态，自身不解释任何私有身份、路径或批准清单。
+- 如实记录依赖评审决策的成本：harness tarball 随 @pnpm/lockfile.fs 闭包扩大；薄运行时属性从零第三方运行时依赖变为三个经评审依赖；pnpm-lockfile 适配器会在 OS 临时目录写一份临时锁文件副本（用后即删）。engineering-kit 的离线消费者验证门随之把第三方闭包推导从单包闭包机械扩展为三个 Foundation 包的完整生产闭包（真实身份去重、npm: 别名感知、range-scoped override selector），使评审决策持续对着真实安装字节被验证。
+- 保持机制纯度：不执行被扫描文件、无模型调用、无网络；永不跟随符号链接。
+
+### 升级说明
+
+0.5.0 是 FND-ADR-010/011 harness 线。机制导入使用 HARNESS_CAPABILITIES 公布的稳定能力名；structured-scan 策略必须通过契约规格 1.5.0 的 structured-scan-policy 契约校验。
+<!-- release-skill:changelog:end version=0.5.0 locale=zh-CN -->
+
+
 <!-- release-skill:changelog:start version=0.4.0 locale=zh-CN baseline=sha256:dafaa1100bf6163a28d53fc982a30e8325d8bd3cab43bbb6daf2e6002befa2c1 -->
 ## [0.4.0] - 2026-08-16
 

package/README.md

@@ -4,30 +4,31 @@
 
 # skill-family-harness-node
 
-<!-- release-skill:release-version: 0.4.0 -->
+<!-- release-skill:release-version: 0.6.0 -->
 
 The **single default Node implementation** of the Contracts mechanism protocol. This is a thin runtime: it only implements the mechanism protocol, introduces no business semantics, and does not provide a second-language implementation.
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.4.0** (2026-08-16)
+**0.6.0** (2026-08-21)
 
-This release adds five finite-closed-semantics mechanisms and a token-lock primitive to the stable Harness surface (FND-ADR-009), grows HARNESS_CAPABILITIES from 9 to 16 entries, and ships the rename-directory-no-replace native-prebuild candidate.
+This release adds bounded subprocess supervision (FND-ADR-012), completes the Foundation strict authority read path with contained nested directory preparation (FG-1), adds pre-persistence URL credential redaction (FG-2), and grows HARNESS_CAPABILITIES from 18 to 21.
 
 **Added**
 
-- Adds five finite-closed-semantics mechanisms (FND-ADR-009), namely frozen-baseline materialization with contentGuard, the generic read chokepoint, strategy-driven surface scanning, deterministic token upper-bound estimation, and the generic upper-bound guard.
-- Adds the token-lock primitive for exclusive token-file publication and digest verification.
-- Grows HARNESS_CAPABILITIES from 9 to 16 entries for the new mechanisms.
-- Adds the rename-directory-no-replace candidate, a native-prebuild addon proving no-replace directory renames on darwin-arm64, darwin-x64, linux-arm64-gnu, and linux-x64-gnu, with a release receipt and SBOM.
+- Adds superviseProcess with validateTimeoutPolicy, WATCHDOG_REASONS, TERMINATION_REASONS, PROCESS_STATUSES and ENVELOPE_GUARANTEES (FND-ADR-012) - one bounded spawn, liveness by explicit events, consumer-supplied timeout policy, SIGTERM then grace then SIGKILL against the process group, and a single closed-enum termination envelope; the mechanism never restarts the supervised process and never holds timeout values.
+- Adds readFileStrict (FG-1), the read-side twin of the strict write path - containment first, symlink refusal with O_NOFOLLOW, regular-file identity re-assertion on the opened handle (dev/ino), and a sha256 digest receipt of the exact bytes read; an optional expectedSha256 content guard fails closed before any delivery.
+- Adds the createParents option to publishFileExclusive (FG-1) - the missing portion of the parent chain is prepared as real directories inside the containment layer and every intermediate entry is re-verified as a real directory; symlink components are still refused and no entry is ever replaced.
+- Adds redactUrlCredentials with REDACTED_URL_PLACEHOLDER (FG-2) - strips the userinfo component from any URL before the value reaches disk or logs; unparseable input degrades to an opaque placeholder and never leaks to the output.
+- Re-exports the contracts-owned token estimate consumption contract (consumeTokenEstimate, consumeTokenEstimateStrict and companions) next to estimateTokens, and carries the authoritative token estimator estimateTokens with the skill-family-token-estimate CLI (audit remediation C1).
 
 **Changed**
 
-- Keeps the Quickstart Profile v2 Task/Result exchange verification delivered in 0.3.0, including real-byte recomputation for path-backed outputs and evidence, duplicate Resource id rejection, and exact evidence binding verification.
-- Leaves method selection, retry policy, and domain result interpretation to the consumer.
+- Grows HARNESS_CAPABILITIES from 18 to 21 (adds supervise-process, strict-read and url-credential-redaction); the strict write path keeps its no-replace, byte-verified receipt semantics unchanged.
+- Keeps business semantics, retry/restart policy, budget thresholds, and the decision of which values are URLs under consumer ownership; the harness owns mechanism only.
 
 **Upgrade Notes**
 
-Version 0.4.0 is released on npm and the public mirror. Pin the candidate subpath to exactly 0.4.0; mechanism imports use the stable capability names published in HARNESS_CAPABILITIES.
+Version 0.6.0 is the Foundation capability completion line. The createParents option of publishFileExclusive is a Foundation-side profile behavior change under the 2026-08-19 discipline; consumers needing contained nested publication must pin exactly 0.6.0.
 <!-- release-skill:managed:end id=latest-release -->
 
 ## Problem It Solves
@@ -41,14 +42,14 @@ The Harness consumes `skill-family-contracts` (a workspace dependency), reusing
 ## Installation and Minimal Example
 
 ```sh
-npm install skill-family-harness-node@0.4.0
+npm install skill-family-harness-node@0.6.0
 npm info skill-family-harness-node --help
 ```
 
 The minimal example shows validating a contract document inside Node:
 
 ```js
-// Run from an empty directory: npm install skill-family-harness-node@0.4.0
+// Run from an empty directory: npm install skill-family-harness-node@0.6.0
 import { validateContractDocument } from "skill-family-harness-node";
 
 const document = {

package/README.zh-CN.md

@@ -5,30 +5,31 @@
 
 # skill-family-harness-node
 
-<!-- release-skill:release-version: 0.4.0 -->
+<!-- release-skill:release-version: 0.6.0 -->
 
 Contracts 机制协议的**唯一默认 Node 实现**。这是一个薄运行时（thin runtime）：只实现机制协议，不引入业务语义，不做第二语言实现。
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.4.0** (2026-08-16)
+**0.6.0** (2026-08-21)
 
-本版在稳定 Harness 面上新增五项有限封闭语义机制与 token-lock 原语（FND-ADR-009），HARNESS_CAPABILITIES 从 9 项增至 16 项，并随附 rename-directory-no-replace 原生预编译候选。
+本版新增有界子进程监督（FND-ADR-012），补齐 Foundation 严格权威读取路径与受收容嵌套目录准备（FG-1），新增落盘前 URL 凭证脱敏（FG-2），HARNESS_CAPABILITIES 从 18 项增至 21 项。
 
 **新增**
 
-- 新增五项有限封闭语义机制（FND-ADR-009）：冻结基线物化 + contentGuard、通用只读 chokepoint、策略化表面扫描、确定性 token 上界估算与通用上限守卫。
-- 新增 token-lock 原语：独占 token 文件发布与摘要复验。
-- HARNESS_CAPABILITIES 从 9 项增至 16 项，覆盖上述新机制。
-- 新增 rename-directory-no-replace 候选：覆盖 darwin-arm64、darwin-x64、linux-arm64-gnu、linux-x64-gnu 的原生预编译 no-replace 目录改名 addon，附带发布 receipt 与 SBOM。
+- 新增 superviseProcess 与 validateTimeoutPolicy、WATCHDOG_REASONS、TERMINATION_REASONS、PROCESS_STATUSES、ENVELOPE_GUARANTEES（FND-ADR-012）：单次有界 spawn、显式事件判活、消费者提供的超时策略、对进程组 SIGTERM→宽限→SIGKILL、单一闭集枚举终止信封；机制从不重启被监督进程，也从不持有超时数值。
+- 新增 readFileStrict（FG-1）：严格写入路径的读取孪生体——先收容、拒绝符号链接（O_NOFOLLOW）、在已打开句柄上复核常规文件身份（dev/ino），并返回所读精确字节的 sha256 摘要回执；可选 expectedSha256 内容守卫在任何交付前失败关闭。
+- publishFileExclusive 新增 createParents 选项（FG-1）：父目录链缺失部分在收容层内准备为真实目录，每个中间条目都复核为真实目录；符号链接组件仍被拒绝，任何条目都不被替换。
+- 新增 redactUrlCredentials 与 REDACTED_URL_PLACEHOLDER（FG-2）：任何 URL 的 userinfo 部分在数值到达磁盘或日志前剥离；不可解析输入退化为不透明占位符，绝不泄漏到输出。
+- 在 estimateTokens 旁转导出 contracts 拥有的 token 估算消费合同（consumeTokenEstimate、consumeTokenEstimateStrict 及伴生常量），并承载权威词元估算器 estimateTokens 与 skill-family-token-estimate CLI（审计整改 C1）。
 
 **变更**
 
-- 保持 0.3.0 交付的 Quickstart Profile v2 Task/Result 交换校验：path-backed output 与 evidence 重算真实字节、拒绝重复 Resource id、evidence 精确绑定逐项复验。
-- 方法选择、重试策略与领域结果解释继续归消费者所有。
+- HARNESS_CAPABILITIES 从 18 项增至 21 项（新增 supervise-process、strict-read、url-credential-redaction）；严格写入路径的不替换、字节验证回执语义保持不变。
+- 业务语义、重试/重启策略、预算阈值与「哪些值是 URL」的判定继续归消费者所有；harness 只拥有机制。
 
 **升级说明**
 
-0.4.0 已发布到 npm 与 public 镜像仓。candidate 子路径必须精确锁定 0.4.0；机制导入使用 HARNESS_CAPABILITIES 公布的稳定能力名。
+0.6.0 是 Foundation 能力补齐线。publishFileExclusive 的 createParents 选项是按 2026-08-19 纪律的 Foundation 侧 profile 行为变更；需要受收容嵌套发布的消费者必须精确锁定 0.6.0。
 <!-- release-skill:managed:end id=latest-release -->
 
 ## 解决的问题
@@ -42,14 +43,14 @@ Harness 消费 `skill-family-contracts`（工作区依赖），复用其方言
 ## 安装和最小示例
 
 ```sh
-npm install skill-family-harness-node@0.4.0
+npm install skill-family-harness-node@0.6.0
 npm info skill-family-harness-node --help
 ```
 
 最小示例演示在 Node 内校验一份契约文档：
 
 ```js
-// 从空目录运行：npm install skill-family-harness-node@0.4.0
+// 从空目录运行：npm install skill-family-harness-node@0.6.0
 import { validateContractDocument } from "skill-family-harness-node";
 
 const document = {

package/package.json

@@ -1,11 +1,17 @@
 {
   "//": "~~ Generated by projen. To modify, edit .projenrc.js and run \"npx projen\".",
   "author": "广州市风荷科技有限公司",
+  "bin": {
+    "skill-family-token-estimate": "./src/token-estimate-cli.mjs"
+  },
   "bugs": {
     "url": "https://github.com/ifoohoo/skill-family-harness-node/issues"
   },
   "dependencies": {
-    "skill-family-contracts": "0.4.0"
+    "@pnpm/lockfile.fs": "1001.1.35",
+    "ipaddr.js": "2.5.0",
+    "skill-family-contracts": "0.6.0",
+    "yaml": "2.9.0"
   },
   "description": "Thin Node.js mechanism runtime for Skill Family engineering contracts.",
   "engines": {
@@ -39,7 +45,7 @@
     "url": "https://github.com/ifoohoo/skill-family-harness-node.git"
   },
   "type": "module",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "scripts": {
     "check": "node --test",
     "test": "node --test"

package/release-notes/0.5.0.yaml

@@ -0,0 +1,29 @@
+version: 0.5.0
+date: 2026-08-16
+locales:
+  en:
+    summary: This release adds the declared read surface assertion (FND-ADR-010) and the structured surface scanner (FND-ADR-011) to the stable Harness surface, growing HARNESS_CAPABILITIES from 16 to 18 entries, and adds three dependency-reviewed runtime libraries.
+    changes:
+      added:
+        - "Adds assertDeclaredReadSurface (FND-ADR-010): a no-execution, syntax-surface-only assertion that every node:fs named import inside a declared module set stays inside the consumer-declared read surface, with a closed violation vocabulary and a frozen declared-read-surface-result envelope."
+        - "Adds scanSurfaceStructured (FND-ADR-011): the structured sibling of scanSurface. IP-shaped candidates enter a single standard parse entry (ipaddr.js) with consumer-declared CIDR approval and fail closed when unparseable; scoped and unscoped coordinates, registries and hosts need consumer-declared approval; format adapters (pnpm-lockfile via @pnpm/lockfile.fs with yaml AST comment regions, and tree-json) parse structurally with no position-level exemptions; binary and symlink policies fail closed. The closed nine-rule vocabulary travels in details.rule of the structured-scan-violation mechanism error."
+        - "Adds three dependency-reviewed runtime libraries for the structured scanner, reviewed per FND-ADR-006 section-4 analogy (dependency-closure pre-review, executor self-review pending independent review): ipaddr.js 2.5.0 (MIT, zero dependencies), yaml 2.9.0 (ISC), and @pnpm/lockfile.fs 1001.1.35 (MIT, 18 transitive dependencies all inside the approved public coordinates)."
+        - Grows HARNESS_CAPABILITIES from 16 to 18 entries for the two new mechanisms.
+      changed:
+        - "Documents the relationship of the two policy documents to workspace-private leak policies: a workspace-private leak-policy.json instance document is not a subset, not isomorphic and not a migration target of the surface-scan-policy or structured-scan-policy schemas — the documents share rule vocabulary and fail-closed semantics by design, but their byte-level shapes are independent and must not be compared for compatibility. scanSurface is the execution-core generalization projection: the public, consumer-parameterized form of the same mechanism family, without any private identity, path, or approval-list interpretation of its own."
+        - "Records the cost of the dependency-review decision honestly: the harness tarball grows with the @pnpm/lockfile.fs closure, the thin-runtime property changes from zero third-party runtime dependencies to three reviewed ones, and the pnpm-lockfile adapter writes one temporary lockfile copy under the OS temp directory (removed afterwards). The engineering-kit offline-consumer verification gates now derive the complete third-party production closure of the three Foundation packages mechanically (identity-deduplicated, npm: alias-aware, range-scoped override selectors) instead of a single-package closure, so the review decision is continuously verified against the real installed bytes."
+        - "Keeps mechanism purity: no execution of scanned files, no model calls, no network; symlinked entries are never followed."
+    upgradeNotes: Version 0.5.0 is the FND-ADR-010/011 harness line. Mechanism imports use the stable capability names published in HARNESS_CAPABILITIES; structured-scan policies must pass the structured-scan-policy contract validation of contract-spec 1.5.0.
+  zh-CN:
+    summary: 本版在稳定 Harness 面上新增声明读取表面断言（FND-ADR-010）与结构化表面扫描器（FND-ADR-011），HARNESS_CAPABILITIES 从 16 项增至 18 项，并引入三个经依赖评审的运行时库。
+    changes:
+      added:
+        - 新增 assertDeclaredReadSurface（FND-ADR-010）：不执行、仅语法面的断言，声明模块集内的每个 node:fs 具名导入必须落在消费者声明的读取表面内，违规词汇表为闭集，返回冻结的 declared-read-surface-result 信封。
+        - 新增 scanSurfaceStructured（FND-ADR-011）：scanSurface 的结构化兄弟。IP 形候选统一进入单一标准解析入口（ipaddr.js），按消费者声明的 CIDR 批准，不可解析即失败关闭；坐标（scoped 与非 scoped）、注册表与主机均需消费者声明批准；格式适配器（pnpm-lockfile 经 @pnpm/lockfile.fs + yaml AST 注释区域，tree-json 经 JSON.parse）结构化解析且无位置级豁免；二进制与符号链接策略失败关闭。闭集九规则词汇表经 structured-scan-violation 机制错误的 details.rule 承载。
+        - 为结构化扫描器引入三个经依赖评审的运行时库，评审按 FND-ADR-006 第 4 节类比执行（依赖闭包预审，执行者自审，独立复核另行安排）：ipaddr.js 2.5.0（MIT，零依赖）、yaml 2.9.0（ISC）、@pnpm/lockfile.fs 1001.1.35（MIT，18 个传递依赖全部在批准公共坐标内）。
+        - HARNESS_CAPABILITIES 从 16 项增至 18 项，覆盖两个新机制。
+      changed:
+        - 显式说明两个策略文档与工作区私有 leak 策略的关系：工作区私有的 leak-policy.json 实例文档既不是 surface-scan-policy 或 structured-scan-policy schema 的子集、也不同构、更不是迁移目标——两类文档按设计共享规则词汇与失败关闭语义，但字节级形状相互独立，不得比较兼容性。scanSurface 是执行内核通用化投影：同一机制族的公开、消费者参数化形态，自身不解释任何私有身份、路径或批准清单。
+        - "如实记录依赖评审决策的成本：harness tarball 随 @pnpm/lockfile.fs 闭包扩大；薄运行时属性从零第三方运行时依赖变为三个经评审依赖；pnpm-lockfile 适配器会在 OS 临时目录写一份临时锁文件副本（用后即删）。engineering-kit 的离线消费者验证门随之把第三方闭包推导从单包闭包机械扩展为三个 Foundation 包的完整生产闭包（真实身份去重、npm: 别名感知、range-scoped override selector），使评审决策持续对着真实安装字节被验证。"
+        - 保持机制纯度：不执行被扫描文件、无模型调用、无网络；永不跟随符号链接。
+    upgradeNotes: 0.5.0 是 FND-ADR-010/011 harness 线。机制导入使用 HARNESS_CAPABILITIES 公布的稳定能力名；structured-scan 策略必须通过契约规格 1.5.0 的 structured-scan-policy 契约校验。

package/release-notes/0.6.0.yaml

@@ -0,0 +1,29 @@
+version: 0.6.0
+date: 2026-08-21
+locales:
+  en:
+    summary: This release adds bounded subprocess supervision (FND-ADR-012), completes the Foundation strict authority read path with contained nested directory preparation (FG-1), adds pre-persistence URL credential redaction (FG-2), and grows HARNESS_CAPABILITIES from 18 to 21.
+    changes:
+      added:
+        - Adds superviseProcess with validateTimeoutPolicy, WATCHDOG_REASONS, TERMINATION_REASONS, PROCESS_STATUSES and ENVELOPE_GUARANTEES (FND-ADR-012) - one bounded spawn, liveness by explicit events, consumer-supplied timeout policy, SIGTERM then grace then SIGKILL against the process group, and a single closed-enum termination envelope; the mechanism never restarts the supervised process and never holds timeout values.
+        - Adds readFileStrict (FG-1), the read-side twin of the strict write path - containment first, symlink refusal with O_NOFOLLOW, regular-file identity re-assertion on the opened handle (dev/ino), and a sha256 digest receipt of the exact bytes read; an optional expectedSha256 content guard fails closed before any delivery.
+        - Adds the createParents option to publishFileExclusive (FG-1) - the missing portion of the parent chain is prepared as real directories inside the containment layer and every intermediate entry is re-verified as a real directory; symlink components are still refused and no entry is ever replaced.
+        - Adds redactUrlCredentials with REDACTED_URL_PLACEHOLDER (FG-2) - strips the userinfo component from any URL before the value reaches disk or logs; unparseable input degrades to an opaque placeholder and never leaks to the output.
+        - Re-exports the contracts-owned token estimate consumption contract (consumeTokenEstimate, consumeTokenEstimateStrict and companions) next to estimateTokens, and carries the authoritative token estimator estimateTokens with the skill-family-token-estimate CLI (audit remediation C1).
+      changed:
+        - Grows HARNESS_CAPABILITIES from 18 to 21 (adds supervise-process, strict-read and url-credential-redaction); the strict write path keeps its no-replace, byte-verified receipt semantics unchanged.
+        - Keeps business semantics, retry/restart policy, budget thresholds, and the decision of which values are URLs under consumer ownership; the harness owns mechanism only.
+    upgradeNotes: Version 0.6.0 is the Foundation capability completion line. The createParents option of publishFileExclusive is a Foundation-side profile behavior change under the 2026-08-19 discipline; consumers needing contained nested publication must pin exactly 0.6.0.
+  zh-CN:
+    summary: 本版新增有界子进程监督（FND-ADR-012），补齐 Foundation 严格权威读取路径与受收容嵌套目录准备（FG-1），新增落盘前 URL 凭证脱敏（FG-2），HARNESS_CAPABILITIES 从 18 项增至 21 项。
+    changes:
+      added:
+        - 新增 superviseProcess 与 validateTimeoutPolicy、WATCHDOG_REASONS、TERMINATION_REASONS、PROCESS_STATUSES、ENVELOPE_GUARANTEES（FND-ADR-012）：单次有界 spawn、显式事件判活、消费者提供的超时策略、对进程组 SIGTERM→宽限→SIGKILL、单一闭集枚举终止信封；机制从不重启被监督进程，也从不持有超时数值。
+        - 新增 readFileStrict（FG-1）：严格写入路径的读取孪生体——先收容、拒绝符号链接（O_NOFOLLOW）、在已打开句柄上复核常规文件身份（dev/ino），并返回所读精确字节的 sha256 摘要回执；可选 expectedSha256 内容守卫在任何交付前失败关闭。
+        - publishFileExclusive 新增 createParents 选项（FG-1）：父目录链缺失部分在收容层内准备为真实目录，每个中间条目都复核为真实目录；符号链接组件仍被拒绝，任何条目都不被替换。
+        - 新增 redactUrlCredentials 与 REDACTED_URL_PLACEHOLDER（FG-2）：任何 URL 的 userinfo 部分在数值到达磁盘或日志前剥离；不可解析输入退化为不透明占位符，绝不泄漏到输出。
+        - 在 estimateTokens 旁转导出 contracts 拥有的 token 估算消费合同（consumeTokenEstimate、consumeTokenEstimateStrict 及伴生常量），并承载权威词元估算器 estimateTokens 与 skill-family-token-estimate CLI（审计整改 C1）。
+      changed:
+        - HARNESS_CAPABILITIES 从 18 项增至 21 项（新增 supervise-process、strict-read、url-credential-redaction）；严格写入路径的不替换、字节验证回执语义保持不变。
+        - 业务语义、重试/重启策略、预算阈值与「哪些值是 URL」的判定继续归消费者所有；harness 只拥有机制。
+    upgradeNotes: 0.6.0 是 Foundation 能力补齐线。publishFileExclusive 的 createParents 选项是按 2026-08-19 纪律的 Foundation 侧 profile 行为变更；需要受收容嵌套发布的消费者必须精确锁定 0.6.0。

package/src/atomic.mjs

@@ -90,7 +90,30 @@ async function runTestHook(name, context) {
   if (typeof testHooks?.[name] === "function") await testHooks[name](context);
 }
 
-async function strictTarget(root, relPath, { target = "optional" } = {}) {
+async function createParentDirectory(cursor, relPath) {
+  try {
+    await mkdir(cursor);
+  } catch (cause) {
+    // EEXIST is a benign concurrent creation race: re-verify the entry below.
+    if (cause?.code !== "EEXIST") {
+      throw mechanismError(
+        HARNESS_ERROR_KINDS.INVALID_ROOT,
+        "strict file operation could not create a missing parent directory",
+        { input: relPath, code: cause?.code },
+      );
+    }
+  }
+  const created = await lstat(cursor);
+  if (created.isSymbolicLink() || !created.isDirectory()) {
+    throw mechanismError(
+      HARNESS_ERROR_KINDS.UNSAFE_STATE_ENTRY,
+      "strict file operation requires real intermediate directories",
+      { input: relPath },
+    );
+  }
+}
+
+async function strictTarget(root, relPath, { target = "optional", createParents = false } = {}) {
   const lexical = await resolveContained(root, relPath);
   const rootReal = await realpath(root);
   const relative = path.relative(rootReal, lexical);
@@ -102,6 +125,10 @@ async function strictTarget(root, relPath, { target = "optional" } = {}) {
     try {
       stats = await lstat(cursor);
     } catch (cause) {
+      if (createParents && cause?.code === "ENOENT") {
+        await createParentDirectory(cursor, relPath);
+        continue;
+      }
       throw mechanismError(
         HARNESS_ERROR_KINDS.INVALID_ROOT,
         "strict file operation requires every parent directory to exist",
@@ -267,17 +294,25 @@ function strictFailure(kind, operation, cause, relPath, committed, verified) {
 }
 
 /**
- * Creates one file without replacing any existing directory entry. The
- * parent must already exist and contain no symlink components. The returned
+ * Creates one file without replacing any existing directory entry. Every
+ * parent must be a real directory and contain no symlink components; with
+ * `createParents` enabled, the missing portion of the parent chain is created
+ * as real directories (any symlink component is still refused). The returned
  * receipt is emitted only after byte/mode/identity verification and directory
  * fsync have completed.
  */
-export async function publishFileExclusive(root, relPath, data, { mode = 0o644 } = {}) {
+export async function publishFileExclusive(
+  root,
+  relPath,
+  data,
+  { mode = 0o644, createParents = false } = {},
+) {
   assertWritableData(data, "publishFileExclusive");
   const normalizedMode = normalizeMode(mode);
   const bytes = bytesOf(data);
   const { targetPath, directory, directoryStats, directoryReal } = await strictTarget(root, relPath, {
     target: "absent",
+    createParents,
   });
   const staging = path.join(
     directory,

package/src/declared-read-surface.mjs

@@ -0,0 +1,198 @@
+import path from "node:path";
+import { readFileSync, readdirSync, statSync } from "node:fs";
+import { HARNESS_ERROR_KINDS, mechanismError } from "./errors.mjs";
+
+/**
+ * Static declared read surface verification (FND-ADR-010).
+ *
+ * assertDeclaredReadSurface({ root, declaredReaders }) checks, by static
+ * source analysis, that every `.mjs`/`.js` module under `root` only reads
+ * node:fs through the consumer-declared reader set:
+ *
+ *   - a module that imports named APIs from "node:fs" without being declared
+ *     violates rule `undeclared-module-imports-fs`;
+ *   - a declared module importing an API outside its declared set violates
+ *     rule `fs-api-outside-declared-set`;
+ *   - any write-family fs API name appearing anywhere in the tree (whole
+ *     source substring detection, including comments and string literals)
+ *     violates rule `write-family-fs-api` (conservative approximation: static
+ *     syntax-level violations are never under-reported).
+ *
+ * The verdict semantics mirror the audit tree's P3 check one-to-one; the
+ * result is shaped as the contracts `declared-read-surface-result` envelope
+ * whose scope, rule enumeration and guarantees are the machine contract.
+ * Input is fully parameterized: root and declaredReaders are consumer data,
+ * the mechanism knows no audit paths, no workspace layout, and no business
+ * meaning of any module.
+ *
+ * Violations are collected as an evidence list (deterministic order:
+ * sorted module list, then rule order per module) rather than stopping at
+ * the first hit; `ok` is false exactly when the list is non-empty.
+ *
+ * Mechanism purity: read-only (never writes, never executes the scanned
+ * modules, no model call, no network); symlinked entries under the root are
+ * never followed and never scanned (conservative: a symlink may not smuggle
+ * a module out of the declared surface).
+ */
+
+const MODULE_EXTENSIONS = [".mjs", ".js"];
+const FS_NAMED_IMPORT_PATTERN = /import\s*\{([^}]*)\}\s*from\s*"node:fs"/g;
+
+// Write-family API names are built by composition so this module's own
+// source never contains the full forbidden names as literals (self-hit
+// hygiene, inherited from the audit tree's P3 check). Detection of scanned
+// modules is unaffected: they would spell the full names.
+const WRITE_FS_VERBS = ["writeFile", "appendFile", "mkdir", "rm", "unlink", "rename", "copyFile"];
+const WRITE_FS_APIS = WRITE_FS_VERBS.map((verb) => `${verb}Sync`).concat([
+  `${"createWrite"}Stream`,
+]);
+
+export const DECLARED_READ_SURFACE_RULES = Object.freeze({
+  UNDECLARED_MODULE_IMPORTS_FS: "undeclared-module-imports-fs",
+  FS_API_OUTSIDE_DECLARED_SET: "fs-api-outside-declared-set",
+  WRITE_FAMILY_FS_API: "write-family-fs-api",
+});
+
+const RESULT_GUARANTEES = Object.freeze([
+  "syntax-surface-only",
+  "conservative-approximation",
+  "no-execution",
+  "no-model-calls",
+  "no-network-access",
+]);
+
+function invalidInput(reason, extra) {
+  return mechanismError(
+    HARNESS_ERROR_KINDS.DECLARED_READ_SURFACE_INVALID,
+    `assertDeclaredReadSurface: ${reason}`,
+    extra,
+  );
+}
+
+function assertPlainObject(value, label) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw invalidInput(`${label} must be a plain object`);
+  }
+}
+
+function isValidDeclaredModulePath(modulePath) {
+  if (typeof modulePath !== "string" || modulePath.length === 0) return false;
+  if (modulePath.includes("\0")) return false;
+  if (modulePath.includes("\\")) return false;
+  if (path.posix.isAbsolute(modulePath)) return false;
+  if (/^[A-Za-z]:/.test(modulePath)) return false;
+  const normalized = path.posix.normalize(modulePath);
+  if (normalized === "." || normalized === "..") return false;
+  if (normalized.split("/").some((segment) => segment === "..")) return false;
+  return normalized === modulePath;
+}
+
+function collectModules(root) {
+  const modules = [];
+  const walk = (directory) => {
+    const entries = readdirSync(directory, { withFileTypes: true }).sort((a, b) =>
+      a.name.localeCompare(b.name),
+    );
+    for (const entry of entries) {
+      if (entry.isSymbolicLink()) continue; // never followed, never scanned
+      const fullPath = path.join(directory, entry.name);
+      if (entry.isDirectory()) {
+        walk(fullPath);
+      } else if (entry.isFile() && MODULE_EXTENSIONS.some((ext) => entry.name.endsWith(ext))) {
+        modules.push(fullPath);
+      }
+    }
+  };
+  walk(root);
+  return modules;
+}
+
+function namedFsImports(source) {
+  return [...source.matchAll(FS_NAMED_IMPORT_PATTERN)].flatMap((match) =>
+    match[1].split(",").map((api) => api.trim()).filter(Boolean),
+  );
+}
+
+/**
+ * Static declared read surface verification. Returns the contracts
+ * declared-read-surface-result envelope (frozen). Invalid inputs (non-empty
+ * root that is not a directory, empty declaredReaders, illegal module path
+ * shapes, malformed declared sets) throw SFC2004 with details.kind
+ * declared-read-surface-invalid; a detected violation is reported in the
+ * result's violations list (ok: false), never as an exception.
+ */
+export function assertDeclaredReadSurface({ root, declaredReaders } = {}) {
+  if (typeof root !== "string" || root.length === 0) {
+    throw invalidInput("root must be a non-empty path");
+  }
+  assertPlainObject(declaredReaders, "declaredReaders");
+  const readerKeys = Object.keys(declaredReaders);
+  if (readerKeys.length === 0) {
+    throw invalidInput("declaredReaders must declare at least one reader module");
+  }
+  const declared = new Map();
+  for (const key of readerKeys) {
+    if (!isValidDeclaredModulePath(key)) {
+      throw invalidInput(`declared reader module path has an illegal shape: ${JSON.stringify(key)}`);
+    }
+    const apis = declaredReaders[key];
+    if (!Array.isArray(apis)) {
+      throw invalidInput(`declared set for ${key} must be an array of fs API names`);
+    }
+    for (const api of apis) {
+      if (typeof api !== "string" || api.length === 0) {
+        throw invalidInput(`declared set for ${key} contains a malformed fs API name`);
+      }
+    }
+    declared.set(key, apis);
+  }
+
+  const rootResolved = path.resolve(root);
+  let rootStat;
+  try {
+    rootStat = statSync(rootResolved);
+  } catch {
+    throw invalidInput("root does not exist or cannot be inspected", { root: "<opaque>" });
+  }
+  if (!rootStat.isDirectory()) {
+    throw invalidInput("root is not a directory", { root: "<opaque>" });
+  }
+
+  const modules = collectModules(rootResolved);
+  const violations = [];
+  const pushViolation = (entry) => violations.push(entry);
+
+  for (const module of modules) {
+    const relative = path.relative(rootResolved, module).split(path.sep).join("/");
+    const source = readFileSync(module, "utf8");
+    const fsImports = namedFsImports(source);
+    const allowed = declared.get(relative);
+    if (fsImports.length > 0 && allowed === undefined) {
+      pushViolation({ module: relative, rule: DECLARED_READ_SURFACE_RULES.UNDECLARED_MODULE_IMPORTS_FS });
+    }
+    if (allowed !== undefined) {
+      for (const api of fsImports) {
+        if (!allowed.includes(api)) {
+          pushViolation({ module: relative, api, rule: DECLARED_READ_SURFACE_RULES.FS_API_OUTSIDE_DECLARED_SET });
+        }
+      }
+    }
+    for (const api of WRITE_FS_APIS) {
+      if (source.includes(api)) {
+        pushViolation({ module: relative, api, rule: DECLARED_READ_SURFACE_RULES.WRITE_FAMILY_FS_API });
+      }
+    }
+  }
+
+  return Object.freeze({
+    schemaVersion: 1,
+    kind: "skill-family.declared-read-surface-result",
+    ok: violations.length === 0,
+    violations,
+    scannedModules: modules.map((module) =>
+      path.relative(rootResolved, module).split(path.sep).join("/"),
+    ),
+    scope: "esm-named-imports-only",
+    guarantees: [...RESULT_GUARANTEES],
+  });
+}

package/src/errors.mjs

@@ -65,7 +65,15 @@ export const HARNESS_ERROR_KINDS = Object.freeze({
   READ_CHOKEPOINT_REJECTED: "read-chokepoint-rejected",
   SURFACE_SCAN_VIOLATION: "surface-scan-violation",
   SCAN_POLICY_INVALID: "scan-policy-invalid",
+  DECLARED_READ_SURFACE_VIOLATION: "declared-read-surface-violation",
+  DECLARED_READ_SURFACE_INVALID: "declared-read-surface-invalid",
+  STRUCTURED_SCAN_VIOLATION: "structured-scan-violation",
+  STRUCTURED_SCAN_INVALID: "structured-scan-invalid",
   UPPER_BOUND_EXCEEDED: "upper-bound-exceeded",
+  // Bounded subprocess supervision (FND-ADR-012). Both kinds report through
+  // SFC2004 with details.kind; the AUD namespace never enters here.
+  TIMEOUT_POLICY_INVALID: "timeout-policy-invalid",
+  SUPERVISE_PROCESS_FAILED: "supervise-process-failed",
 });
 
 /**