skill-family-harness-node 0.5.0 → 0.7.0

package/CHANGELOG.md

@@ -1,5 +1,44 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.7.0 locale=en baseline=sha256:062a81c93d213982e9d6beda1e574959ba98b18170f0c703efb0dd71573a3e77 -->
+## [0.7.0] - 2026-08-21
+
+Lockstep version bump with the Foundation 0.7.0 line; the thin mechanism runtime is unchanged.
+
+### Changed
+
+- No capability change - HARNESS_CAPABILITIES stays at 21 items and every exported mechanism (atomic contained writes, path containment, strict authority read, resource closure, digests, bounded subprocess supervision, URL credential redaction) keeps its 0.6.0 contract; the package version moves in lockstep with the Foundation line because the three leaf packages share one public version coordinate.
+
+### Upgrade Notes
+
+Version 0.7.0 carries no harness surface change. Consumers keep their existing pins; the harness computeResourceClosure resource closure remains distinct from the Kit plan closure introduced by engineering-kit 0.7.0 and the two are not interchangeable.
+<!-- release-skill:changelog:end version=0.7.0 locale=en -->
+
+
+<!-- release-skill:changelog:start version=0.6.0 locale=en baseline=sha256:c67e713aebe53382c651655a2be9e78ace8da6a1b7852c1e6acadcb383ff2422 -->
+## [0.6.0] - 2026-08-21
+
+This release adds bounded subprocess supervision (FND-ADR-012), completes the Foundation strict authority read path with contained nested directory preparation (FG-1), adds pre-persistence URL credential redaction (FG-2), and grows HARNESS_CAPABILITIES from 18 to 21.
+
+### Added
+
+- Adds superviseProcess with validateTimeoutPolicy, WATCHDOG_REASONS, TERMINATION_REASONS, PROCESS_STATUSES and ENVELOPE_GUARANTEES (FND-ADR-012) - one bounded spawn, liveness by explicit events, consumer-supplied timeout policy, SIGTERM then grace then SIGKILL against the process group, and a single closed-enum termination envelope; the mechanism never restarts the supervised process and never holds timeout values.
+- Adds readFileStrict (FG-1), the read-side twin of the strict write path - containment first, symlink refusal with O_NOFOLLOW, regular-file identity re-assertion on the opened handle (dev/ino), and a sha256 digest receipt of the exact bytes read; an optional expectedSha256 content guard fails closed before any delivery.
+- Adds the createParents option to publishFileExclusive (FG-1) - the missing portion of the parent chain is prepared as real directories inside the containment layer and every intermediate entry is re-verified as a real directory; symlink components are still refused and no entry is ever replaced.
+- Adds redactUrlCredentials with REDACTED_URL_PLACEHOLDER (FG-2) - strips the userinfo component from any URL before the value reaches disk or logs; unparseable input degrades to an opaque placeholder and never leaks to the output.
+- Re-exports the contracts-owned token estimate consumption contract (consumeTokenEstimate, consumeTokenEstimateStrict and companions) next to estimateTokens, and carries the authoritative token estimator estimateTokens with the skill-family-token-estimate CLI (audit remediation C1).
+
+### Changed
+
+- Grows HARNESS_CAPABILITIES from 18 to 21 (adds supervise-process, strict-read and url-credential-redaction); the strict write path keeps its no-replace, byte-verified receipt semantics unchanged.
+- Keeps business semantics, retry/restart policy, budget thresholds, and the decision of which values are URLs under consumer ownership; the harness owns mechanism only.
+
+### Upgrade Notes
+
+Version 0.6.0 is the Foundation capability completion line. The createParents option of publishFileExclusive is a Foundation-side profile behavior change under the 2026-08-19 discipline; consumers needing contained nested publication must pin exactly 0.6.0.
+<!-- release-skill:changelog:end version=0.6.0 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.5.0 locale=en baseline=sha256:03eca87a8c9bea814e741518168696f17c869bdb71baf2046cef4c3596d9ebf3 -->
 ## [0.5.0] - 2026-08-16
 

package/CHANGELOG.zh-CN.md

@@ -1,5 +1,44 @@
 # 变更日志
 
+<!-- release-skill:changelog:start version=0.7.0 locale=zh-CN baseline=sha256:b3c207e2dd4134b75e5219842ee64a43c6da964763a86f7e360f0d0b60667516 -->
+## [0.7.0] - 2026-08-21
+
+随 Foundation 0.7.0 线锁步升版；薄机制运行时不变。
+
+### 变更
+
+- 能力无变更——HARNESS_CAPABILITIES 保持 21 项，全部导出机制（原子受收容写、路径收容、严格权威读取、资源闭包、摘要、有界子进程监督、URL 凭证脱敏）保持 0.6.0 合同；包版本随 Foundation 线锁步，因为三个叶子包共用同一公开版本坐标。
+
+### 升级说明
+
+0.7.0 不携带任何 harness 表面变更。消费者保持既有锁定；harness computeResourceClosure 的资源闭包与 engineering-kit 0.7.0 引入的 Kit 计划闭包仍然形状不同、用途不同，二者不能互换。
+<!-- release-skill:changelog:end version=0.7.0 locale=zh-CN -->
+
+
+<!-- release-skill:changelog:start version=0.6.0 locale=zh-CN baseline=sha256:6a4a94f692909faf2090445638988b27841a8bca67a85fd7812864d656299175 -->
+## [0.6.0] - 2026-08-21
+
+本版新增有界子进程监督（FND-ADR-012），补齐 Foundation 严格权威读取路径与受收容嵌套目录准备（FG-1），新增落盘前 URL 凭证脱敏（FG-2），HARNESS_CAPABILITIES 从 18 项增至 21 项。
+
+### 新增
+
+- 新增 superviseProcess 与 validateTimeoutPolicy、WATCHDOG_REASONS、TERMINATION_REASONS、PROCESS_STATUSES、ENVELOPE_GUARANTEES（FND-ADR-012）：单次有界 spawn、显式事件判活、消费者提供的超时策略、对进程组 SIGTERM→宽限→SIGKILL、单一闭集枚举终止信封；机制从不重启被监督进程，也从不持有超时数值。
+- 新增 readFileStrict（FG-1）：严格写入路径的读取孪生体——先收容、拒绝符号链接（O_NOFOLLOW）、在已打开句柄上复核常规文件身份（dev/ino），并返回所读精确字节的 sha256 摘要回执；可选 expectedSha256 内容守卫在任何交付前失败关闭。
+- publishFileExclusive 新增 createParents 选项（FG-1）：父目录链缺失部分在收容层内准备为真实目录，每个中间条目都复核为真实目录；符号链接组件仍被拒绝，任何条目都不被替换。
+- 新增 redactUrlCredentials 与 REDACTED_URL_PLACEHOLDER（FG-2）：任何 URL 的 userinfo 部分在数值到达磁盘或日志前剥离；不可解析输入退化为不透明占位符，绝不泄漏到输出。
+- 在 estimateTokens 旁转导出 contracts 拥有的 token 估算消费合同（consumeTokenEstimate、consumeTokenEstimateStrict 及伴生常量），并承载权威词元估算器 estimateTokens 与 skill-family-token-estimate CLI（审计整改 C1）。
+
+### 变更
+
+- HARNESS_CAPABILITIES 从 18 项增至 21 项（新增 supervise-process、strict-read、url-credential-redaction）；严格写入路径的不替换、字节验证回执语义保持不变。
+- 业务语义、重试/重启策略、预算阈值与「哪些值是 URL」的判定继续归消费者所有；harness 只拥有机制。
+
+### 升级说明
+
+0.6.0 是 Foundation 能力补齐线。publishFileExclusive 的 createParents 选项是按 2026-08-19 纪律的 Foundation 侧 profile 行为变更；需要受收容嵌套发布的消费者必须精确锁定 0.6.0。
+<!-- release-skill:changelog:end version=0.6.0 locale=zh-CN -->
+
+
 <!-- release-skill:changelog:start version=0.5.0 locale=zh-CN baseline=sha256:003472359596147fe26ad2ba53a82303a217c28cb89a6afacdaa955793001f71 -->
 ## [0.5.0] - 2026-08-16
 

package/README.md

@@ -4,31 +4,22 @@
 
 # skill-family-harness-node
 
-<!-- release-skill:release-version: 0.5.0 -->
+<!-- release-skill:release-version: 0.7.0 -->
 
 The **single default Node implementation** of the Contracts mechanism protocol. This is a thin runtime: it only implements the mechanism protocol, introduces no business semantics, and does not provide a second-language implementation.
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.5.0** (2026-08-16)
+**0.7.0** (2026-08-21)
 
-This release adds the declared read surface assertion (FND-ADR-010) and the structured surface scanner (FND-ADR-011) to the stable Harness surface, growing HARNESS_CAPABILITIES from 16 to 18 entries, and adds three dependency-reviewed runtime libraries.
-
-**Added**
-
-- Adds assertDeclaredReadSurface (FND-ADR-010): a no-execution, syntax-surface-only assertion that every node:fs named import inside a declared module set stays inside the consumer-declared read surface, with a closed violation vocabulary and a frozen declared-read-surface-result envelope.
-- Adds scanSurfaceStructured (FND-ADR-011): the structured sibling of scanSurface. IP-shaped candidates enter a single standard parse entry (ipaddr.js) with consumer-declared CIDR approval and fail closed when unparseable; scoped and unscoped coordinates, registries and hosts need consumer-declared approval; format adapters (pnpm-lockfile via @pnpm/lockfile.fs with yaml AST comment regions, and tree-json) parse structurally with no position-level exemptions; binary and symlink policies fail closed. The closed nine-rule vocabulary travels in details.rule of the structured-scan-violation mechanism error.
-- Adds three dependency-reviewed runtime libraries for the structured scanner, reviewed per FND-ADR-006 section-4 analogy (dependency-closure pre-review, executor self-review pending independent review): ipaddr.js 2.5.0 (MIT, zero dependencies), yaml 2.9.0 (ISC), and @pnpm/lockfile.fs 1001.1.35 (MIT, 18 transitive dependencies all inside the approved public coordinates).
-- Grows HARNESS_CAPABILITIES from 16 to 18 entries for the two new mechanisms.
+Lockstep version bump with the Foundation 0.7.0 line; the thin mechanism runtime is unchanged.
 
 **Changed**
 
-- Documents the relationship of the two policy documents to workspace-private leak policies: a workspace-private leak-policy.json instance document is not a subset, not isomorphic and not a migration target of the surface-scan-policy or structured-scan-policy schemas — the documents share rule vocabulary and fail-closed semantics by design, but their byte-level shapes are independent and must not be compared for compatibility. scanSurface is the execution-core generalization projection: the public, consumer-parameterized form of the same mechanism family, without any private identity, path, or approval-list interpretation of its own.
-- Records the cost of the dependency-review decision honestly: the harness tarball grows with the @pnpm/lockfile.fs closure, the thin-runtime property changes from zero third-party runtime dependencies to three reviewed ones, and the pnpm-lockfile adapter writes one temporary lockfile copy under the OS temp directory (removed afterwards). The engineering-kit offline-consumer verification gates now derive the complete third-party production closure of the three Foundation packages mechanically (identity-deduplicated, npm: alias-aware, range-scoped override selectors) instead of a single-package closure, so the review decision is continuously verified against the real installed bytes.
-- Keeps mechanism purity: no execution of scanned files, no model calls, no network; symlinked entries are never followed.
+- No capability change - HARNESS_CAPABILITIES stays at 21 items and every exported mechanism (atomic contained writes, path containment, strict authority read, resource closure, digests, bounded subprocess supervision, URL credential redaction) keeps its 0.6.0 contract; the package version moves in lockstep with the Foundation line because the three leaf packages share one public version coordinate.
 
 **Upgrade Notes**
 
-Version 0.5.0 is the FND-ADR-010/011 harness line. Mechanism imports use the stable capability names published in HARNESS_CAPABILITIES; structured-scan policies must pass the structured-scan-policy contract validation of contract-spec 1.5.0.
+Version 0.7.0 carries no harness surface change. Consumers keep their existing pins; the harness computeResourceClosure resource closure remains distinct from the Kit plan closure introduced by engineering-kit 0.7.0 and the two are not interchangeable.
 <!-- release-skill:managed:end id=latest-release -->
 
 ## Problem It Solves
@@ -42,14 +33,14 @@ The Harness consumes `skill-family-contracts` (a workspace dependency), reusing
 ## Installation and Minimal Example
 
 ```sh
-npm install skill-family-harness-node@0.5.0
+npm install skill-family-harness-node@0.7.0
 npm info skill-family-harness-node --help
 ```
 
 The minimal example shows validating a contract document inside Node:
 
 ```js
-// Run from an empty directory: npm install skill-family-harness-node@0.5.0
+// Run from an empty directory: npm install skill-family-harness-node@0.7.0
 import { validateContractDocument } from "skill-family-harness-node";
 
 const document = {

package/README.zh-CN.md

@@ -5,31 +5,22 @@
 
 # skill-family-harness-node
 
-<!-- release-skill:release-version: 0.5.0 -->
+<!-- release-skill:release-version: 0.7.0 -->
 
 Contracts 机制协议的**唯一默认 Node 实现**。这是一个薄运行时（thin runtime）：只实现机制协议，不引入业务语义，不做第二语言实现。
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.5.0** (2026-08-16)
+**0.7.0** (2026-08-21)
 
-本版在稳定 Harness 面上新增声明读取表面断言（FND-ADR-010）与结构化表面扫描器（FND-ADR-011），HARNESS_CAPABILITIES 从 16 项增至 18 项，并引入三个经依赖评审的运行时库。
-
-**新增**
-
-- 新增 assertDeclaredReadSurface（FND-ADR-010）：不执行、仅语法面的断言，声明模块集内的每个 node:fs 具名导入必须落在消费者声明的读取表面内，违规词汇表为闭集，返回冻结的 declared-read-surface-result 信封。
-- 新增 scanSurfaceStructured（FND-ADR-011）：scanSurface 的结构化兄弟。IP 形候选统一进入单一标准解析入口（ipaddr.js），按消费者声明的 CIDR 批准，不可解析即失败关闭；坐标（scoped 与非 scoped）、注册表与主机均需消费者声明批准；格式适配器（pnpm-lockfile 经 @pnpm/lockfile.fs + yaml AST 注释区域，tree-json 经 JSON.parse）结构化解析且无位置级豁免；二进制与符号链接策略失败关闭。闭集九规则词汇表经 structured-scan-violation 机制错误的 details.rule 承载。
-- 为结构化扫描器引入三个经依赖评审的运行时库，评审按 FND-ADR-006 第 4 节类比执行（依赖闭包预审，执行者自审，独立复核另行安排）：ipaddr.js 2.5.0（MIT，零依赖）、yaml 2.9.0（ISC）、@pnpm/lockfile.fs 1001.1.35（MIT，18 个传递依赖全部在批准公共坐标内）。
-- HARNESS_CAPABILITIES 从 16 项增至 18 项，覆盖两个新机制。
+随 Foundation 0.7.0 线锁步升版；薄机制运行时不变。
 
 **变更**
 
-- 显式说明两个策略文档与工作区私有 leak 策略的关系：工作区私有的 leak-policy.json 实例文档既不是 surface-scan-policy 或 structured-scan-policy schema 的子集、也不同构、更不是迁移目标——两类文档按设计共享规则词汇与失败关闭语义，但字节级形状相互独立，不得比较兼容性。scanSurface 是执行内核通用化投影：同一机制族的公开、消费者参数化形态，自身不解释任何私有身份、路径或批准清单。
-- 如实记录依赖评审决策的成本：harness tarball 随 @pnpm/lockfile.fs 闭包扩大；薄运行时属性从零第三方运行时依赖变为三个经评审依赖；pnpm-lockfile 适配器会在 OS 临时目录写一份临时锁文件副本（用后即删）。engineering-kit 的离线消费者验证门随之把第三方闭包推导从单包闭包机械扩展为三个 Foundation 包的完整生产闭包（真实身份去重、npm: 别名感知、range-scoped override selector），使评审决策持续对着真实安装字节被验证。
-- 保持机制纯度：不执行被扫描文件、无模型调用、无网络；永不跟随符号链接。
+- 能力无变更——HARNESS_CAPABILITIES 保持 21 项，全部导出机制（原子受收容写、路径收容、严格权威读取、资源闭包、摘要、有界子进程监督、URL 凭证脱敏）保持 0.6.0 合同；包版本随 Foundation 线锁步，因为三个叶子包共用同一公开版本坐标。
 
 **升级说明**
 
-0.5.0 是 FND-ADR-010/011 harness 线。机制导入使用 HARNESS_CAPABILITIES 公布的稳定能力名；structured-scan 策略必须通过契约规格 1.5.0 的 structured-scan-policy 契约校验。
+0.7.0 不携带任何 harness 表面变更。消费者保持既有锁定；harness computeResourceClosure 的资源闭包与 engineering-kit 0.7.0 引入的 Kit 计划闭包仍然形状不同、用途不同，二者不能互换。
 <!-- release-skill:managed:end id=latest-release -->
 
 ## 解决的问题
@@ -43,14 +34,14 @@ Harness 消费 `skill-family-contracts`（工作区依赖），复用其方言
 ## 安装和最小示例
 
 ```sh
-npm install skill-family-harness-node@0.5.0
+npm install skill-family-harness-node@0.7.0
 npm info skill-family-harness-node --help
 ```
 
 最小示例演示在 Node 内校验一份契约文档：
 
 ```js
-// 从空目录运行：npm install skill-family-harness-node@0.5.0
+// 从空目录运行：npm install skill-family-harness-node@0.7.0
 import { validateContractDocument } from "skill-family-harness-node";
 
 const document = {

package/package.json

@@ -1,13 +1,16 @@
 {
   "//": "~~ Generated by projen. To modify, edit .projenrc.js and run \"npx projen\".",
   "author": "广州市风荷科技有限公司",
+  "bin": {
+    "skill-family-token-estimate": "./src/token-estimate-cli.mjs"
+  },
   "bugs": {
     "url": "https://github.com/ifoohoo/skill-family-harness-node/issues"
   },
   "dependencies": {
     "@pnpm/lockfile.fs": "1001.1.35",
     "ipaddr.js": "2.5.0",
-    "skill-family-contracts": "0.5.0",
+    "skill-family-contracts": "0.7.0",
     "yaml": "2.9.0"
   },
   "description": "Thin Node.js mechanism runtime for Skill Family engineering contracts.",
@@ -42,7 +45,7 @@
     "url": "https://github.com/ifoohoo/skill-family-harness-node.git"
   },
   "type": "module",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "scripts": {
     "check": "node --test",
     "test": "node --test"

package/release-notes/0.6.0.yaml

@@ -0,0 +1,29 @@
+version: 0.6.0
+date: 2026-08-21
+locales:
+  en:
+    summary: This release adds bounded subprocess supervision (FND-ADR-012), completes the Foundation strict authority read path with contained nested directory preparation (FG-1), adds pre-persistence URL credential redaction (FG-2), and grows HARNESS_CAPABILITIES from 18 to 21.
+    changes:
+      added:
+        - Adds superviseProcess with validateTimeoutPolicy, WATCHDOG_REASONS, TERMINATION_REASONS, PROCESS_STATUSES and ENVELOPE_GUARANTEES (FND-ADR-012) - one bounded spawn, liveness by explicit events, consumer-supplied timeout policy, SIGTERM then grace then SIGKILL against the process group, and a single closed-enum termination envelope; the mechanism never restarts the supervised process and never holds timeout values.
+        - Adds readFileStrict (FG-1), the read-side twin of the strict write path - containment first, symlink refusal with O_NOFOLLOW, regular-file identity re-assertion on the opened handle (dev/ino), and a sha256 digest receipt of the exact bytes read; an optional expectedSha256 content guard fails closed before any delivery.
+        - Adds the createParents option to publishFileExclusive (FG-1) - the missing portion of the parent chain is prepared as real directories inside the containment layer and every intermediate entry is re-verified as a real directory; symlink components are still refused and no entry is ever replaced.
+        - Adds redactUrlCredentials with REDACTED_URL_PLACEHOLDER (FG-2) - strips the userinfo component from any URL before the value reaches disk or logs; unparseable input degrades to an opaque placeholder and never leaks to the output.
+        - Re-exports the contracts-owned token estimate consumption contract (consumeTokenEstimate, consumeTokenEstimateStrict and companions) next to estimateTokens, and carries the authoritative token estimator estimateTokens with the skill-family-token-estimate CLI (audit remediation C1).
+      changed:
+        - Grows HARNESS_CAPABILITIES from 18 to 21 (adds supervise-process, strict-read and url-credential-redaction); the strict write path keeps its no-replace, byte-verified receipt semantics unchanged.
+        - Keeps business semantics, retry/restart policy, budget thresholds, and the decision of which values are URLs under consumer ownership; the harness owns mechanism only.
+    upgradeNotes: Version 0.6.0 is the Foundation capability completion line. The createParents option of publishFileExclusive is a Foundation-side profile behavior change under the 2026-08-19 discipline; consumers needing contained nested publication must pin exactly 0.6.0.
+  zh-CN:
+    summary: 本版新增有界子进程监督（FND-ADR-012），补齐 Foundation 严格权威读取路径与受收容嵌套目录准备（FG-1），新增落盘前 URL 凭证脱敏（FG-2），HARNESS_CAPABILITIES 从 18 项增至 21 项。
+    changes:
+      added:
+        - 新增 superviseProcess 与 validateTimeoutPolicy、WATCHDOG_REASONS、TERMINATION_REASONS、PROCESS_STATUSES、ENVELOPE_GUARANTEES（FND-ADR-012）：单次有界 spawn、显式事件判活、消费者提供的超时策略、对进程组 SIGTERM→宽限→SIGKILL、单一闭集枚举终止信封；机制从不重启被监督进程，也从不持有超时数值。
+        - 新增 readFileStrict（FG-1）：严格写入路径的读取孪生体——先收容、拒绝符号链接（O_NOFOLLOW）、在已打开句柄上复核常规文件身份（dev/ino），并返回所读精确字节的 sha256 摘要回执；可选 expectedSha256 内容守卫在任何交付前失败关闭。
+        - publishFileExclusive 新增 createParents 选项（FG-1）：父目录链缺失部分在收容层内准备为真实目录，每个中间条目都复核为真实目录；符号链接组件仍被拒绝，任何条目都不被替换。
+        - 新增 redactUrlCredentials 与 REDACTED_URL_PLACEHOLDER（FG-2）：任何 URL 的 userinfo 部分在数值到达磁盘或日志前剥离；不可解析输入退化为不透明占位符，绝不泄漏到输出。
+        - 在 estimateTokens 旁转导出 contracts 拥有的 token 估算消费合同（consumeTokenEstimate、consumeTokenEstimateStrict 及伴生常量），并承载权威词元估算器 estimateTokens 与 skill-family-token-estimate CLI（审计整改 C1）。
+      changed:
+        - HARNESS_CAPABILITIES 从 18 项增至 21 项（新增 supervise-process、strict-read、url-credential-redaction）；严格写入路径的不替换、字节验证回执语义保持不变。
+        - 业务语义、重试/重启策略、预算阈值与「哪些值是 URL」的判定继续归消费者所有；harness 只拥有机制。
+    upgradeNotes: 0.6.0 是 Foundation 能力补齐线。publishFileExclusive 的 createParents 选项是按 2026-08-19 纪律的 Foundation 侧 profile 行为变更；需要受收容嵌套发布的消费者必须精确锁定 0.6.0。

package/release-notes/0.7.0.yaml

@@ -0,0 +1,15 @@
+version: 0.7.0
+date: 2026-08-21
+locales:
+  en:
+    summary: Lockstep version bump with the Foundation 0.7.0 line; the thin mechanism runtime is unchanged.
+    changes:
+      changed:
+        - No capability change - HARNESS_CAPABILITIES stays at 21 items and every exported mechanism (atomic contained writes, path containment, strict authority read, resource closure, digests, bounded subprocess supervision, URL credential redaction) keeps its 0.6.0 contract; the package version moves in lockstep with the Foundation line because the three leaf packages share one public version coordinate.
+    upgradeNotes: Version 0.7.0 carries no harness surface change. Consumers keep their existing pins; the harness computeResourceClosure resource closure remains distinct from the Kit plan closure introduced by engineering-kit 0.7.0 and the two are not interchangeable.
+  zh-CN:
+    summary: 随 Foundation 0.7.0 线锁步升版；薄机制运行时不变。
+    changes:
+      changed:
+        - 能力无变更——HARNESS_CAPABILITIES 保持 21 项，全部导出机制（原子受收容写、路径收容、严格权威读取、资源闭包、摘要、有界子进程监督、URL 凭证脱敏）保持 0.6.0 合同；包版本随 Foundation 线锁步，因为三个叶子包共用同一公开版本坐标。
+    upgradeNotes: 0.7.0 不携带任何 harness 表面变更。消费者保持既有锁定；harness computeResourceClosure 的资源闭包与 engineering-kit 0.7.0 引入的 Kit 计划闭包仍然形状不同、用途不同，二者不能互换。

package/src/atomic.mjs

@@ -90,7 +90,30 @@ async function runTestHook(name, context) {
   if (typeof testHooks?.[name] === "function") await testHooks[name](context);
 }
 
-async function strictTarget(root, relPath, { target = "optional" } = {}) {
+async function createParentDirectory(cursor, relPath) {
+  try {
+    await mkdir(cursor);
+  } catch (cause) {
+    // EEXIST is a benign concurrent creation race: re-verify the entry below.
+    if (cause?.code !== "EEXIST") {
+      throw mechanismError(
+        HARNESS_ERROR_KINDS.INVALID_ROOT,
+        "strict file operation could not create a missing parent directory",
+        { input: relPath, code: cause?.code },
+      );
+    }
+  }
+  const created = await lstat(cursor);
+  if (created.isSymbolicLink() || !created.isDirectory()) {
+    throw mechanismError(
+      HARNESS_ERROR_KINDS.UNSAFE_STATE_ENTRY,
+      "strict file operation requires real intermediate directories",
+      { input: relPath },
+    );
+  }
+}
+
+async function strictTarget(root, relPath, { target = "optional", createParents = false } = {}) {
   const lexical = await resolveContained(root, relPath);
   const rootReal = await realpath(root);
   const relative = path.relative(rootReal, lexical);
@@ -102,6 +125,10 @@ async function strictTarget(root, relPath, { target = "optional" } = {}) {
     try {
       stats = await lstat(cursor);
     } catch (cause) {
+      if (createParents && cause?.code === "ENOENT") {
+        await createParentDirectory(cursor, relPath);
+        continue;
+      }
       throw mechanismError(
         HARNESS_ERROR_KINDS.INVALID_ROOT,
         "strict file operation requires every parent directory to exist",
@@ -267,17 +294,25 @@ function strictFailure(kind, operation, cause, relPath, committed, verified) {
 }
 
 /**
- * Creates one file without replacing any existing directory entry. The
- * parent must already exist and contain no symlink components. The returned
+ * Creates one file without replacing any existing directory entry. Every
+ * parent must be a real directory and contain no symlink components; with
+ * `createParents` enabled, the missing portion of the parent chain is created
+ * as real directories (any symlink component is still refused). The returned
  * receipt is emitted only after byte/mode/identity verification and directory
  * fsync have completed.
  */
-export async function publishFileExclusive(root, relPath, data, { mode = 0o644 } = {}) {
+export async function publishFileExclusive(
+  root,
+  relPath,
+  data,
+  { mode = 0o644, createParents = false } = {},
+) {
   assertWritableData(data, "publishFileExclusive");
   const normalizedMode = normalizeMode(mode);
   const bytes = bytesOf(data);
   const { targetPath, directory, directoryStats, directoryReal } = await strictTarget(root, relPath, {
     target: "absent",
+    createParents,
   });
   const staging = path.join(
     directory,

package/src/errors.mjs

@@ -70,6 +70,10 @@ export const HARNESS_ERROR_KINDS = Object.freeze({
   STRUCTURED_SCAN_VIOLATION: "structured-scan-violation",
   STRUCTURED_SCAN_INVALID: "structured-scan-invalid",
   UPPER_BOUND_EXCEEDED: "upper-bound-exceeded",
+  // Bounded subprocess supervision (FND-ADR-012). Both kinds report through
+  // SFC2004 with details.kind; the AUD namespace never enters here.
+  TIMEOUT_POLICY_INVALID: "timeout-policy-invalid",
+  SUPERVISE_PROCESS_FAILED: "supervise-process-failed",
 });
 
 /**

package/src/index.mjs

@@ -29,6 +29,11 @@ export const HARNESS_CAPABILITIES = Object.freeze([
   "structured-scan",
   "token-estimation",
   "upper-bound-guard",
+  "supervise-process",
+  // Foundation capability completion (FG-1/FG-2): strict authority reads and
+  // pre-persistence URL credential redaction.
+  "strict-read",
+  "url-credential-redaction",
 ]);
 
 export const HARNESS_EXCLUSIONS = Object.freeze([
@@ -44,6 +49,14 @@ export { HarnessError, HARNESS_ERROR_KINDS, mechanismError } from "./errors.mjs"
 
 export { classifyPathInput, resolveContained, readFileContained } from "./paths.mjs";
 
+// Strict contained read (FG-1): no-follow, regular-file identity assertion,
+// and a post-read sha256 digest receipt for existing authority files.
+export { readFileStrict } from "./strict-read.mjs";
+
+// Generic URL credential redaction (FG-2): strip userinfo before any value
+// reaches disk or logs; unparseable input degrades to an opaque placeholder.
+export { redactUrlCredentials, REDACTED_URL_PLACEHOLDER } from "./url-redaction.mjs";
+
 export { writeFileAtomic, publishFileExclusive, publishFileOrReplace, replaceFileAtomic } from "./atomic.mjs";
 
 export {
@@ -72,7 +85,26 @@ export { assertDeclaredReadSurface } from "./declared-read-surface.mjs";
 
 export { scanSurfaceStructured, STRUCTURED_SCAN_RULES, isIpv6ShapedRun, extractIpCandidates, normalizeIpToken, classifyIpToken, collectLockfileCommentRegions } from "./structured-scan.mjs";
 
-export { estimateTokenUpperBound } from "./token-estimate.mjs";
+export {
+  estimateTokenUpperBound,
+  estimateTokens,
+  isCjkCodePoint,
+  CJK_CODE_POINT_RANGES,
+  TOKEN_ESTIMATOR_ID,
+  TOKEN_ESTIMATOR_VERSION,
+  TOKEN_ESTIMATION_ALGORITHM,
+} from "./token-estimate.mjs";
+
+// Minimal consumption contract of the token estimate record (SG-33): the
+// contracts-owned consumption functions are re-exported next to the estimator
+// so mechanism consumers keep one import surface. Pure functions only.
+export {
+  TOKEN_ESTIMATE_CONSUMPTION,
+  TOKEN_ESTIMATE_CONSUMPTION_REASONS,
+  TOKEN_ESTIMATE_CONSUMPTION_ERROR_KIND,
+  consumeTokenEstimate,
+  consumeTokenEstimateStrict,
+} from "skill-family-contracts";
 
 export {
   openUsageGuard,
@@ -81,6 +113,21 @@ export {
   closeUsageGuard,
 } from "./budget-guard.mjs";
 
+// Bounded subprocess supervision (FND-ADR-012). Mechanism only: one bounded
+// spawn, liveness by explicit events, consumer-supplied timeout policy,
+// SIGTERM -> grace -> SIGKILL against the process group, terminal-progress
+// observation, and a single closed-enum termination envelope. The mechanism
+// never restarts the supervised process and never holds timeout values;
+// retry/restart policy and budget thresholds stay consumer-owned.
+export {
+  superviseProcess,
+  validateTimeoutPolicy,
+  WATCHDOG_REASONS,
+  TERMINATION_REASONS,
+  PROCESS_STATUSES,
+  ENVELOPE_GUARANTEES,
+} from "./supervise-process.mjs";
+
 export { digestBytes, computeResourceClosure, closureContains } from "./closure.mjs";
 
 export {

package/src/strict-read.mjs

@@ -0,0 +1,148 @@
+import { constants as FS_CONSTANTS } from "node:fs";
+import { lstat, open } from "node:fs/promises";
+import { digestBytes } from "./closure.mjs";
+import { HARNESS_ERROR_KINDS, mechanismError } from "./errors.mjs";
+import { resolveContained } from "./paths.mjs";
+
+/**
+ * Strict contained read (FG-1).
+ *
+ * readFileStrict is the read-side twin of the strict write path: it reads one
+ * existing authority file through the containment layer and proves, in order,
+ *
+ *   1. containment       — resolveContained rejects traversal and escape
+ *                          classes before any read;
+ *   2. no-follow         — a symbolic-link target is refused outright (even
+ *                          when it resolves inside the root), and the file is
+ *                          opened with O_NOFOLLOW so a link swapped in after
+ *                          the identity check can never be followed;
+ *   3. regular identity  — the target must be one ordinary file; the handle
+ *                          opened for reading is re-statted and compared
+ *                          against the pre-open identity (dev/ino);
+ *   4. digest receipt    — the returned receipt carries the sha256 of the
+ *                          exact bytes that were read, so a consumer can
+ *                          recompute and bind the read without trusting the
+ *                          transport.
+ *
+ * When the consumer already holds a frozen digest (an approval authority, a
+ * frozen plan), pass expectedSha256: any difference fails closed with the
+ * stable content-guard-rejected kind and the content is not delivered.
+ */
+
+const SHA256_HEX_PATTERN = /^[0-9a-f]{64}$/;
+
+function sameIdentity(left, right) {
+  return left.dev === right.dev && left.ino === right.ino;
+}
+
+/**
+ * Strictly reads one contained regular file.
+ *
+ * @param {string} root     workspace root directory.
+ * @param {string} relPath  contained relative path.
+ * @param {object} [options]
+ * @param {"utf8"} [options.encoding]        decode content as a utf8 string;
+ *                                           Buffer content when omitted. No
+ *                                           other encoding is accepted.
+ * @param {string} [options.expectedSha256]  frozen lowercase sha256 hex digest
+ *                                           the read bytes must match.
+ * @returns {Promise<{path: string, content: Buffer|string, sha256: string, bytes: number, mode: number}>}
+ *          frozen receipt emitted after the read; `sha256` is the digest of
+ *          exactly the bytes returned in `content`.
+ */
+export async function readFileStrict(root, relPath, { encoding, expectedSha256 } = {}) {
+  if (encoding !== undefined && encoding !== "utf8") {
+    throw new TypeError('readFileStrict: encoding must be "utf8" or undefined');
+  }
+  if (expectedSha256 !== undefined && (typeof expectedSha256 !== "string" || !SHA256_HEX_PATTERN.test(expectedSha256))) {
+    throw new TypeError("readFileStrict: expectedSha256 must be a lowercase sha256 hex digest");
+  }
+
+  const target = await resolveContained(root, relPath);
+
+  let before;
+  try {
+    before = await lstat(target);
+  } catch (cause) {
+    if (cause?.code === "ENOENT" || cause?.code === "ENOTDIR") {
+      throw mechanismError(
+        HARNESS_ERROR_KINDS.MISSING_RESOURCE,
+        "strict read target does not exist",
+        { input: relPath },
+      );
+    }
+    throw mechanismError(
+      HARNESS_ERROR_KINDS.READ_FAILED,
+      `strict read cannot inspect the target: ${cause?.code ?? "unknown"}`,
+      { input: relPath },
+    );
+  }
+  if (before.isSymbolicLink()) {
+    throw mechanismError(
+      HARNESS_ERROR_KINDS.UNSAFE_STATE_ENTRY,
+      "strict read refuses a symbolic-link target (no-follow)",
+      { input: relPath },
+    );
+  }
+  if (!before.isFile()) {
+    throw mechanismError(
+      HARNESS_ERROR_KINDS.READ_FAILED,
+      "strict read requires one ordinary file",
+      { input: relPath, actual: before.isDirectory() ? "directory" : "special" },
+    );
+  }
+
+  const noFollow = FS_CONSTANTS.O_NOFOLLOW ?? 0;
+  let handle;
+  try {
+    handle = await open(target, FS_CONSTANTS.O_RDONLY | noFollow);
+  } catch (cause) {
+    if (cause?.code === "ENOENT") {
+      throw mechanismError(
+        HARNESS_ERROR_KINDS.MISSING_RESOURCE,
+        "strict read target disappeared before open",
+        { input: relPath },
+      );
+    }
+    if (cause?.code === "ELOOP") {
+      throw mechanismError(
+        HARNESS_ERROR_KINDS.UNSAFE_STATE_ENTRY,
+        "strict read target became a symbolic link before open (no-follow)",
+        { input: relPath },
+      );
+    }
+    throw mechanismError(
+      HARNESS_ERROR_KINDS.READ_FAILED,
+      `strict read failed to open the target: ${cause?.code ?? "unknown"}`,
+      { input: relPath },
+    );
+  }
+  try {
+    const opened = await handle.stat();
+    if (!sameIdentity(before, opened) || !opened.isFile()) {
+      throw mechanismError(
+        HARNESS_ERROR_KINDS.UNSAFE_STATE_ENTRY,
+        "strict read target identity changed during inspection",
+        { input: relPath },
+      );
+    }
+    const bytes = await handle.readFile();
+    const sha256 = digestBytes(bytes);
+    if (expectedSha256 !== undefined && sha256 !== expectedSha256) {
+      throw mechanismError(
+        HARNESS_ERROR_KINDS.CONTENT_GUARD_REJECTED,
+        "strict read digest differs from the expected frozen digest",
+        { input: relPath, expectedSha256, actualSha256: sha256 },
+      );
+    }
+    return Object.freeze({
+      path: target,
+      content: encoding === "utf8" ? bytes.toString("utf8") : bytes,
+      sha256,
+      bytes: bytes.length,
+      mode: opened.mode & 0o7777,
+    });
+  } finally {
+    await handle.close();
+  }
+}