skill-family-harness-node 0.6.0 → 0.7.0

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.7.0 locale=en baseline=sha256:062a81c93d213982e9d6beda1e574959ba98b18170f0c703efb0dd71573a3e77 -->
+## [0.7.0] - 2026-08-21
+
+Lockstep version bump with the Foundation 0.7.0 line; the thin mechanism runtime is unchanged.
+
+### Changed
+
+- No capability change - HARNESS_CAPABILITIES stays at 21 items and every exported mechanism (atomic contained writes, path containment, strict authority read, resource closure, digests, bounded subprocess supervision, URL credential redaction) keeps its 0.6.0 contract; the package version moves in lockstep with the Foundation line because the three leaf packages share one public version coordinate.
+
+### Upgrade Notes
+
+Version 0.7.0 carries no harness surface change. Consumers keep their existing pins; the harness computeResourceClosure resource closure remains distinct from the Kit plan closure introduced by engineering-kit 0.7.0 and the two are not interchangeable.
+<!-- release-skill:changelog:end version=0.7.0 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.6.0 locale=en baseline=sha256:c67e713aebe53382c651655a2be9e78ace8da6a1b7852c1e6acadcb383ff2422 -->
 ## [0.6.0] - 2026-08-21
 

package/CHANGELOG.zh-CN.md

@@ -1,5 +1,20 @@
 # 变更日志
 
+<!-- release-skill:changelog:start version=0.7.0 locale=zh-CN baseline=sha256:b3c207e2dd4134b75e5219842ee64a43c6da964763a86f7e360f0d0b60667516 -->
+## [0.7.0] - 2026-08-21
+
+随 Foundation 0.7.0 线锁步升版；薄机制运行时不变。
+
+### 变更
+
+- 能力无变更——HARNESS_CAPABILITIES 保持 21 项，全部导出机制（原子受收容写、路径收容、严格权威读取、资源闭包、摘要、有界子进程监督、URL 凭证脱敏）保持 0.6.0 合同；包版本随 Foundation 线锁步，因为三个叶子包共用同一公开版本坐标。
+
+### 升级说明
+
+0.7.0 不携带任何 harness 表面变更。消费者保持既有锁定；harness computeResourceClosure 的资源闭包与 engineering-kit 0.7.0 引入的 Kit 计划闭包仍然形状不同、用途不同，二者不能互换。
+<!-- release-skill:changelog:end version=0.7.0 locale=zh-CN -->
+
+
 <!-- release-skill:changelog:start version=0.6.0 locale=zh-CN baseline=sha256:6a4a94f692909faf2090445638988b27841a8bca67a85fd7812864d656299175 -->
 ## [0.6.0] - 2026-08-21
 

package/CODE_OF_CONDUCT.md

@@ -0,0 +1,131 @@
+# 贡献者公约（Contributor Covenant Code of Conduct）
+
+本行为准则采用 Contributor Covenant 2.1 标准文本，来源明确：
+`https://www.contributor-covenant.org/version/2/1/code_of_conduct/`。
+译文与解读以英文原文为准；执行联系方式见文末。
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, religion, or sexual identity
+and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+* Focusing on what is best not just for us as individuals, but for the
+  overall community
+
+Examples of unacceptable behavior include:
+
+* The use of sexualized language or imagery, and sexual attention or
+  advances of any kind
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or email
+  address, without their explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, and will communicate reasons for moderation
+decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+Examples of representing our community include using an official e-mail address,
+posting via an official social media account, or acting as an appointed
+representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement through the
+source repository's private channels (see SECURITY.md for private reporting).
+All complaints will be reviewed and investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining
+the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed
+unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing
+clarity around the nature of the violation and an explanation of why the
+behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series
+of actions.
+
+**Consequence**: A warning with consequences for continued behavior. No
+interaction with the people involved, including unsolicited interaction with
+those enforcing the Code of Conduct, for a specified period of time. This
+includes avoiding interactions in community spaces as well as external channels
+like social media. Violating these terms may lead to a temporary or
+permanent ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including
+sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public
+communication with the community for a specified period of time. No public or
+private interaction with the people involved, including unsolicited interaction
+with those enforcing the Code of Conduct, is allowed during this period.
+Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community
+standards, including sustained inappropriate behavior, harassment of an
+individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within
+the community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.1, available at
+`https://www.contributor-covenant.org/version/2/1/code_of_conduct/`.
+
+Community Impact Guidelines were inspired by Mozilla's code of conduct
+enforcement ladder.
+
+For answers to common questions about this code of conduct, see the FAQ at
+`https://www.contributor-covenant.org/faq`.
+
+[homepage]: https://www.contributor-covenant.org

package/CONTRIBUTING.md

@@ -0,0 +1,25 @@
+# 贡献指南（skill-family-harness-node）
+
+本仓是 `skill-family-harness-node` 的公开发布镜像，只承载版本化发布物。开发在私有工作区进行，不在本仓公开。
+
+## 问题报告
+
+Bug 报告请在本仓 GitHub Issues 提交：https://github.com/ifoohoo/skill-family-harness-node/issues
+
+提交时请尽量提供：受影响版本、最小复现步骤、预期与实际行为。
+
+## 代码贡献
+
+未经事先讨论的 Pull Request 不予接受。请先通过 Issue 讨论变更的动机与范围，获得维护者确认后再提交 PR。
+
+## 行为准则
+
+互动请遵守本仓 CODE_OF_CONDUCT.md。
+
+## 安全报告
+
+漏洞报告渠道见本仓 SECURITY.md。请走 Private vulnerability reporting，不要以公开 Issue 提交漏洞。
+
+## 许可证
+
+贡献内容默认按 Apache-2.0 授权，与本包许可证一致。

package/README.md

@@ -4,31 +4,22 @@
 
 # skill-family-harness-node
 
-<!-- release-skill:release-version: 0.6.0 -->
+<!-- release-skill:release-version: 0.7.0 -->
 
 The **single default Node implementation** of the Contracts mechanism protocol. This is a thin runtime: it only implements the mechanism protocol, introduces no business semantics, and does not provide a second-language implementation.
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.6.0** (2026-08-21)
+**0.7.0** (2026-08-21)
 
-This release adds bounded subprocess supervision (FND-ADR-012), completes the Foundation strict authority read path with contained nested directory preparation (FG-1), adds pre-persistence URL credential redaction (FG-2), and grows HARNESS_CAPABILITIES from 18 to 21.
-
-**Added**
-
-- Adds superviseProcess with validateTimeoutPolicy, WATCHDOG_REASONS, TERMINATION_REASONS, PROCESS_STATUSES and ENVELOPE_GUARANTEES (FND-ADR-012) - one bounded spawn, liveness by explicit events, consumer-supplied timeout policy, SIGTERM then grace then SIGKILL against the process group, and a single closed-enum termination envelope; the mechanism never restarts the supervised process and never holds timeout values.
-- Adds readFileStrict (FG-1), the read-side twin of the strict write path - containment first, symlink refusal with O_NOFOLLOW, regular-file identity re-assertion on the opened handle (dev/ino), and a sha256 digest receipt of the exact bytes read; an optional expectedSha256 content guard fails closed before any delivery.
-- Adds the createParents option to publishFileExclusive (FG-1) - the missing portion of the parent chain is prepared as real directories inside the containment layer and every intermediate entry is re-verified as a real directory; symlink components are still refused and no entry is ever replaced.
-- Adds redactUrlCredentials with REDACTED_URL_PLACEHOLDER (FG-2) - strips the userinfo component from any URL before the value reaches disk or logs; unparseable input degrades to an opaque placeholder and never leaks to the output.
-- Re-exports the contracts-owned token estimate consumption contract (consumeTokenEstimate, consumeTokenEstimateStrict and companions) next to estimateTokens, and carries the authoritative token estimator estimateTokens with the skill-family-token-estimate CLI (audit remediation C1).
+Lockstep version bump with the Foundation 0.7.0 line; the thin mechanism runtime is unchanged.
 
 **Changed**
 
-- Grows HARNESS_CAPABILITIES from 18 to 21 (adds supervise-process, strict-read and url-credential-redaction); the strict write path keeps its no-replace, byte-verified receipt semantics unchanged.
-- Keeps business semantics, retry/restart policy, budget thresholds, and the decision of which values are URLs under consumer ownership; the harness owns mechanism only.
+- No capability change - HARNESS_CAPABILITIES stays at 21 items and every exported mechanism (atomic contained writes, path containment, strict authority read, resource closure, digests, bounded subprocess supervision, URL credential redaction) keeps its 0.6.0 contract; the package version moves in lockstep with the Foundation line because the three leaf packages share one public version coordinate.
 
 **Upgrade Notes**
 
-Version 0.6.0 is the Foundation capability completion line. The createParents option of publishFileExclusive is a Foundation-side profile behavior change under the 2026-08-19 discipline; consumers needing contained nested publication must pin exactly 0.6.0.
+Version 0.7.0 carries no harness surface change. Consumers keep their existing pins; the harness computeResourceClosure resource closure remains distinct from the Kit plan closure introduced by engineering-kit 0.7.0 and the two are not interchangeable.
 <!-- release-skill:managed:end id=latest-release -->
 
 ## Problem It Solves
@@ -42,14 +33,14 @@ The Harness consumes `skill-family-contracts` (a workspace dependency), reusing
 ## Installation and Minimal Example
 
 ```sh
-npm install skill-family-harness-node@0.6.0
+npm install skill-family-harness-node@0.7.0
 npm info skill-family-harness-node --help
 ```
 
 The minimal example shows validating a contract document inside Node:
 
 ```js
-// Run from an empty directory: npm install skill-family-harness-node@0.6.0
+// Run from an empty directory: npm install skill-family-harness-node@0.7.0
 import { validateContractDocument } from "skill-family-harness-node";
 
 const document = {

package/README.zh-CN.md

@@ -5,31 +5,22 @@
 
 # skill-family-harness-node
 
-<!-- release-skill:release-version: 0.6.0 -->
+<!-- release-skill:release-version: 0.7.0 -->
 
 Contracts 机制协议的**唯一默认 Node 实现**。这是一个薄运行时（thin runtime）：只实现机制协议，不引入业务语义，不做第二语言实现。
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.6.0** (2026-08-21)
+**0.7.0** (2026-08-21)
 
-本版新增有界子进程监督（FND-ADR-012），补齐 Foundation 严格权威读取路径与受收容嵌套目录准备（FG-1），新增落盘前 URL 凭证脱敏（FG-2），HARNESS_CAPABILITIES 从 18 项增至 21 项。
-
-**新增**
-
-- 新增 superviseProcess 与 validateTimeoutPolicy、WATCHDOG_REASONS、TERMINATION_REASONS、PROCESS_STATUSES、ENVELOPE_GUARANTEES（FND-ADR-012）：单次有界 spawn、显式事件判活、消费者提供的超时策略、对进程组 SIGTERM→宽限→SIGKILL、单一闭集枚举终止信封；机制从不重启被监督进程，也从不持有超时数值。
-- 新增 readFileStrict（FG-1）：严格写入路径的读取孪生体——先收容、拒绝符号链接（O_NOFOLLOW）、在已打开句柄上复核常规文件身份（dev/ino），并返回所读精确字节的 sha256 摘要回执；可选 expectedSha256 内容守卫在任何交付前失败关闭。
-- publishFileExclusive 新增 createParents 选项（FG-1）：父目录链缺失部分在收容层内准备为真实目录，每个中间条目都复核为真实目录；符号链接组件仍被拒绝，任何条目都不被替换。
-- 新增 redactUrlCredentials 与 REDACTED_URL_PLACEHOLDER（FG-2）：任何 URL 的 userinfo 部分在数值到达磁盘或日志前剥离；不可解析输入退化为不透明占位符，绝不泄漏到输出。
-- 在 estimateTokens 旁转导出 contracts 拥有的 token 估算消费合同（consumeTokenEstimate、consumeTokenEstimateStrict 及伴生常量），并承载权威词元估算器 estimateTokens 与 skill-family-token-estimate CLI（审计整改 C1）。
+随 Foundation 0.7.0 线锁步升版；薄机制运行时不变。
 
 **变更**
 
-- HARNESS_CAPABILITIES 从 18 项增至 21 项（新增 supervise-process、strict-read、url-credential-redaction）；严格写入路径的不替换、字节验证回执语义保持不变。
-- 业务语义、重试/重启策略、预算阈值与「哪些值是 URL」的判定继续归消费者所有；harness 只拥有机制。
+- 能力无变更——HARNESS_CAPABILITIES 保持 21 项，全部导出机制（原子受收容写、路径收容、严格权威读取、资源闭包、摘要、有界子进程监督、URL 凭证脱敏）保持 0.6.0 合同；包版本随 Foundation 线锁步，因为三个叶子包共用同一公开版本坐标。
 
 **升级说明**
 
-0.6.0 是 Foundation 能力补齐线。publishFileExclusive 的 createParents 选项是按 2026-08-19 纪律的 Foundation 侧 profile 行为变更；需要受收容嵌套发布的消费者必须精确锁定 0.6.0。
+0.7.0 不携带任何 harness 表面变更。消费者保持既有锁定；harness computeResourceClosure 的资源闭包与 engineering-kit 0.7.0 引入的 Kit 计划闭包仍然形状不同、用途不同，二者不能互换。
 <!-- release-skill:managed:end id=latest-release -->
 
 ## 解决的问题
@@ -43,14 +34,14 @@ Harness 消费 `skill-family-contracts`（工作区依赖），复用其方言
 ## 安装和最小示例
 
 ```sh
-npm install skill-family-harness-node@0.6.0
+npm install skill-family-harness-node@0.7.0
 npm info skill-family-harness-node --help
 ```
 
 最小示例演示在 Node 内校验一份契约文档：
 
 ```js
-// 从空目录运行：npm install skill-family-harness-node@0.6.0
+// 从空目录运行：npm install skill-family-harness-node@0.7.0
 import { validateContractDocument } from "skill-family-harness-node";
 
 const document = {

package/SECURITY.md

@@ -0,0 +1,33 @@
+# 安全策略（Security Policy）
+
+## 支持的版本
+
+| 版本 | 安全支持状态 |
+| --- | --- |
+| 0.1.x | 当前维护线：接受安全报告 |
+| 0.0.0 | 未发布的内部骨架版本，不在公开支持范围 |
+
+安全修复只承诺在最新的 0.1.x 线上提供；更早版本不回移修复。
+
+## 报告漏洞
+
+请勿通过公开 issue 直接披露未修复的安全漏洞。private workspace 仓永久
+private，不是公开报告渠道；请通过任一 public 发布镜像仓（例如
+`https://github.com/ifoohoo/skill-family-engineering-kit`）在 GitHub 上使用
+**Private vulnerability reporting**（仓库 Security 页签的
+"Report a vulnerability"）私下报告。
+
+报告时请尽量提供：
+
+- 受影响的包与版本（`skill-family-contracts`、`skill-family-harness-node`、
+  `skill-family-engineering-kit`）；
+- 可复现的最小步骤或概念验证；
+- 影响范围与利用前提。
+
+## 处置承诺
+
+- 收到报告后先确认受理，再按影响面排期修复；
+- 修复发布前不公开披露细节；
+- 修复随下一个补丁版本发布，并在该版本的变更记录中说明。
+
+本文件只描述漏洞报告渠道与支持版本；实时发布状态不属于本文件范围。

package/package.json

@@ -10,7 +10,7 @@
   "dependencies": {
     "@pnpm/lockfile.fs": "1001.1.35",
     "ipaddr.js": "2.5.0",
-    "skill-family-contracts": "0.6.0",
+    "skill-family-contracts": "0.7.0",
     "yaml": "2.9.0"
   },
   "description": "Thin Node.js mechanism runtime for Skill Family engineering contracts.",
@@ -45,7 +45,7 @@
     "url": "https://github.com/ifoohoo/skill-family-harness-node.git"
   },
   "type": "module",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "scripts": {
     "check": "node --test",
     "test": "node --test"

package/release-notes/0.7.0.yaml

@@ -0,0 +1,15 @@
+version: 0.7.0
+date: 2026-08-21
+locales:
+  en:
+    summary: Lockstep version bump with the Foundation 0.7.0 line; the thin mechanism runtime is unchanged.
+    changes:
+      changed:
+        - No capability change - HARNESS_CAPABILITIES stays at 21 items and every exported mechanism (atomic contained writes, path containment, strict authority read, resource closure, digests, bounded subprocess supervision, URL credential redaction) keeps its 0.6.0 contract; the package version moves in lockstep with the Foundation line because the three leaf packages share one public version coordinate.
+    upgradeNotes: Version 0.7.0 carries no harness surface change. Consumers keep their existing pins; the harness computeResourceClosure resource closure remains distinct from the Kit plan closure introduced by engineering-kit 0.7.0 and the two are not interchangeable.
+  zh-CN:
+    summary: 随 Foundation 0.7.0 线锁步升版；薄机制运行时不变。
+    changes:
+      changed:
+        - 能力无变更——HARNESS_CAPABILITIES 保持 21 项，全部导出机制（原子受收容写、路径收容、严格权威读取、资源闭包、摘要、有界子进程监督、URL 凭证脱敏）保持 0.6.0 合同；包版本随 Foundation 线锁步，因为三个叶子包共用同一公开版本坐标。
+    upgradeNotes: 0.7.0 不携带任何 harness 表面变更。消费者保持既有锁定；harness computeResourceClosure 的资源闭包与 engineering-kit 0.7.0 引入的 Kit 计划闭包仍然形状不同、用途不同，二者不能互换。