skill-family-harness-node 0.8.3 → 0.9.0

package/CHANGELOG.md

@@ -1,5 +1,42 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.9.0 locale=en baseline=sha256:e5f4e3bb6ab343e4ccfb7dcdbba8b9ab4576b4cf285c30bb3597d577be5eb391 -->
+## [0.9.0] - 2026-08-24
+
+Harness 0.9.0 adds stable identity-bound reads and fixed-set no-replace publication with a fixed four-platform native closure.
+
+### Added
+
+- Adds createFilesystemRootBinding and readFileBound with handle-relative no-follow acquisition and optional byte digest guarding.
+- Adds the stable fixed-set-publication subpath with native no-replace publication and terminal indeterminate receipts.
+- Adds the candidate validate-many-by-schema-id mechanism to the existing Quickstart dispatcher.
+
+### Changed
+
+- Keeps protected deletion excluded and preserves the existing 21-item capability registry.
+
+### Upgrade Notes
+
+Pin Contracts, Harness, and Engineering Kit to exactly 0.9.0. Batch validation and the Quickstart Bundle remain candidate; filesystem binding and fixed-set publication are stable.
+<!-- release-skill:changelog:end version=0.9.0 locale=en -->
+
+
+<!-- release-skill:changelog:start version=0.8.4 locale=en baseline=sha256:dfb053d7719d3c7cb5b7d8dbe7a2349597696614651ef4ae04451c34cd7bbc02 -->
+## [0.8.4] - 2026-08-24
+
+Lockstep Foundation 0.8.4 version update with no new Harness mechanism or public API.
+
+### Changed
+
+- Moves the package version to 0.8.4 together with Contracts and Engineering Kit.
+- Keeps all 21 Harness capabilities and public exports unchanged; source-authority receipt validation belongs to Contracts.
+
+### Upgrade Notes
+
+Consumers must pin all three Foundation packages to exactly 0.8.4. No Harness API migration is required.
+<!-- release-skill:changelog:end version=0.8.4 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.8.3 locale=en baseline=sha256:449943bedf3698888fec4dcb09a0460f337b9406d5258946a3d3ffcd23143b8d -->
 ## [0.8.3] - 2026-08-23
 

package/CHANGELOG.zh-CN.md

@@ -1,5 +1,42 @@
 # 变更日志
 
+<!-- release-skill:changelog:start version=0.9.0 locale=zh-CN baseline=sha256:7f3ff503831b8fb52f20293a4af4003ff116b7f9d820a0c2da1bd34a0b261248 -->
+## [0.9.0] - 2026-08-24
+
+Harness 0.9.0 新增稳定身份绑定读取与固定集合不替换发布，并携带固定四平台原生闭包。
+
+### 新增
+
+- 新增 createFilesystemRootBinding 与 readFileBound，使用句柄相对不跟随符号链接获取，并支持可选字节摘要保护。
+- 新增稳定 fixed-set-publication 子路径，使用原生不替换发布并保留终态 indeterminate 回执。
+- 在既有 Quickstart dispatcher 中增加 validate-many-by-schema-id candidate 机制。
+
+### 变更
+
+- 身份保护删除继续排除，既有 21 项能力登记保持不变。
+
+### 升级说明
+
+三个 Foundation 包必须精确锁定 0.9.0。批量校验与 Quickstart Bundle 仍为 candidate；文件系统绑定与固定集合发布为 stable。
+<!-- release-skill:changelog:end version=0.9.0 locale=zh-CN -->
+
+
+<!-- release-skill:changelog:start version=0.8.4 locale=zh-CN baseline=sha256:e8d7be87a26ef296ee4ae27e2325ac8ff1dc33fc69e5f4a65520656f9860bb91 -->
+## [0.8.4] - 2026-08-24
+
+随 Foundation 0.8.4 锁步升版；Harness 不新增机制或公共 API。
+
+### 变更
+
+- 包版本与 Contracts、Engineering Kit 一同升至 0.8.4。
+- 21 项 Harness 能力与公共导出保持不变；source-authority receipt 校验归 Contracts。
+
+### 升级说明
+
+消费者必须把三个 Foundation 包精确锁定到 0.8.4；Harness API 无需迁移。
+<!-- release-skill:changelog:end version=0.8.4 locale=zh-CN -->
+
+
 <!-- release-skill:changelog:start version=0.8.3 locale=zh-CN baseline=sha256:b84695a286aca7c1a9f90844f8682cde07d32276cebc11583568bc5ef11753fc -->
 ## [0.8.3] - 2026-08-23
 

package/README.md

@@ -4,28 +4,28 @@
 
 # skill-family-harness-node
 
-<!-- release-skill:release-version: 0.8.3 -->
+<!-- release-skill:release-version: 0.9.0 -->
 
 The **single default Node implementation** of the Contracts mechanism protocol. This is a thin runtime: it only implements the mechanism protocol, introduces no business semantics, and does not provide a second-language implementation.
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.8.3** (2026-08-23)
+**0.9.0** (2026-08-24)
 
-Path containment now tolerates one exact anchor-removal race while preserving fail-closed escape checks.
+Harness 0.9.0 adds stable identity-bound reads and fixed-set no-replace publication with a fixed four-platform native closure.
 
-**Changed**
+**Added**
 
-- A second ENOENT and every non-ENOENT failure remain closed; symlink swaps, out-of-root targets, and all existing containment checks remain rejected.
-- Keeps the hook private to the paths module test surface and adds no public export, general retry policy, lock layer, ledger, or runner.
-- Moves the package version to 0.8.3 together with Contracts and Engineering Kit.
+- Adds createFilesystemRootBinding and readFileBound with handle-relative no-follow acquisition and optional byte digest guarding.
+- Adds the stable fixed-set-publication subpath with native no-replace publication and terminal indeterminate receipts.
+- Adds the candidate validate-many-by-schema-id mechanism to the existing Quickstart dispatcher.
 
-**Fixed**
+**Changed**
 
-- When realpath of the selected existing anchor fails with ENOENT because another process removed it, resolveContained recomputes the deepest existing ancestor exactly once.
+- Keeps protected deletion excluded and preserves the existing 21-item capability registry.
 
 **Upgrade Notes**
 
-Consumers must pin all three Foundation packages to exactly 0.8.3. Concurrent lock acquisition can now survive the current owner removing the selected lock-file anchor; no Harness API migration is required.
+Pin Contracts, Harness, and Engineering Kit to exactly 0.9.0. Batch validation and the Quickstart Bundle remain candidate; filesystem binding and fixed-set publication are stable.
 <!-- release-skill:managed:end id=latest-release -->
 
 ## Problem It Solves
@@ -39,14 +39,14 @@ The Harness consumes `skill-family-contracts` (a workspace dependency), reusing
 ## Installation and Minimal Example
 
 ```sh
-npm install skill-family-harness-node@0.8.3
+npm install skill-family-harness-node@0.9.0
 npm info skill-family-harness-node --help
 ```
 
 The minimal example shows validating a contract document inside Node:
 
 ```js
-// Run from an empty directory: npm install skill-family-harness-node@0.8.3
+// Run from an empty directory: npm install skill-family-harness-node@0.9.0
 import { validateContractDocument } from "skill-family-harness-node";
 
 const document = {

package/README.zh-CN.md

@@ -5,28 +5,28 @@
 
 # skill-family-harness-node
 
-<!-- release-skill:release-version: 0.8.3 -->
+<!-- release-skill:release-version: 0.9.0 -->
 
 Contracts 机制协议的**唯一默认 Node 实现**。这是一个薄运行时（thin runtime）：只实现机制协议，不引入业务语义，不做第二语言实现。
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.8.3** (2026-08-23)
+**0.9.0** (2026-08-24)
 
-路径收容现在可处理一次精确的锚点并发删除，同时保持越界检查失败关闭。
+Harness 0.9.0 新增稳定身份绑定读取与固定集合不替换发布，并携带固定四平台原生闭包。
 
-**变更**
+**新增**
 
-- 第二次 ENOENT 与所有非 ENOENT 错误仍失败关闭；符号链接替换、根目录外目标和既有收容检查仍全部拒绝。
-- 测试钩子只留在 paths 模块的测试表面，不新增公共导出、通用重试策略、锁层、账本或 runner。
-- 包版本与 Contracts、Engineering Kit 一同升至 0.8.3。
+- 新增 createFilesystemRootBinding 与 readFileBound，使用句柄相对不跟随符号链接获取，并支持可选字节摘要保护。
+- 新增稳定 fixed-set-publication 子路径，使用原生不替换发布并保留终态 indeterminate 回执。
+- 在既有 Quickstart dispatcher 中增加 validate-many-by-schema-id candidate 机制。
 
-**修复**
+**变更**
 
-- 当另一进程删除已选锚点，导致该锚点的 realpath 返回 ENOENT 时，resolveContained 仅重新计算一次最深既存祖先。
+- 身份保护删除继续排除，既有 21 项能力登记保持不变。
 
 **升级说明**
 
-消费者必须把三个 Foundation 包精确锁定到 0.8.3。并发获取锁时，即使当前持有者删除已选锁文件锚点，也能完成一次安全重求；Harness API 无需迁移。
+三个 Foundation 包必须精确锁定 0.9.0。批量校验与 Quickstart Bundle 仍为 candidate；文件系统绑定与固定集合发布为 stable。
 <!-- release-skill:managed:end id=latest-release -->
 
 ## 解决的问题
@@ -40,14 +40,14 @@ Harness 消费 `skill-family-contracts`（工作区依赖），复用其方言
 ## 安装和最小示例
 
 ```sh
-npm install skill-family-harness-node@0.8.3
+npm install skill-family-harness-node@0.9.0
 npm info skill-family-harness-node --help
 ```
 
 最小示例演示在 Node 内校验一份契约文档：
 
 ```js
-// 从空目录运行：npm install skill-family-harness-node@0.8.3
+// 从空目录运行：npm install skill-family-harness-node@0.9.0
 import { validateContractDocument } from "skill-family-harness-node";
 
 const document = {

package/candidate/mechanisms-cli.mjs

@@ -22,6 +22,8 @@ function errorResponse(cause) {
     error: {
       name: typeof cause?.name === "string" ? cause.name : "Error",
       message: cause?.message ?? String(cause),
+      ...(typeof cause?.code === "string" ? { code: cause.code } : {}),
+      ...(cause?.details !== undefined ? { details: cause.details } : {}),
     },
   };
 }

package/candidate/quickstart-profile.mjs

@@ -1,4 +1,4 @@
-import { canonicalJson, digestDocument, isRegisteredErrorCode } from "skill-family-contracts";
+import { canonicalJson, ContractsError, digestDocument, isRegisteredErrorCode } from "skill-family-contracts";
 import {
   QUICKSTART_PROTOCOL,
   findNonJsonValue,
@@ -452,6 +452,7 @@ export async function verifyHarnessSurfaceInventory({ root, inventory, detectors
 
 const FOUNDATION_MECHANISM_OPERATIONS = Object.freeze([
   "validate-by-schema-id",
+  "validate-many-by-schema-id",
   "canonical-json",
   "digest-document",
   "resource-closure",
@@ -518,7 +519,48 @@ async function invokeReadFileStrict(params) {
  * several Foundation modules directly. validateBySchemaId is injected only
  * by the trusted offline Bundle; callers cannot name arbitrary functions.
  */
-export async function invokeFoundationMechanism(request, { validateBySchemaId } = {}) {
+function assertBatchRequest(request) {
+  if (Object.keys(request).sort().join(",") !== "operation,params" ||
+      request.operation !== "validate-many-by-schema-id" ||
+      request.params === null || typeof request.params !== "object" || Array.isArray(request.params) ||
+      Object.keys(request.params).sort().join(",") !== "requests" ||
+      !Array.isArray(request.params.requests) || request.params.requests.length === 0) {
+    throw new TypeError("invokeFoundationMechanism: validate-many-by-schema-id request is malformed");
+  }
+  for (const item of request.params.requests) {
+    if (item === null || typeof item !== "object" || Array.isArray(item) ||
+        Object.keys(item).sort().join(",") !== "document,schemaId" ||
+        typeof item.schemaId !== "string" || item.schemaId.length === 0) {
+      throw new TypeError("invokeFoundationMechanism: validate-many-by-schema-id item is malformed");
+    }
+  }
+}
+
+function invokeValidationBatch(request, { validateBySchemaId, listValidatableSchemaIds } = {}) {
+  assertBatchRequest(request);
+  if (typeof validateBySchemaId !== "function" || typeof listValidatableSchemaIds !== "function") {
+    throw new TypeError("invokeFoundationMechanism: validate-many-by-schema-id requires the trusted Bundle validator index");
+  }
+  const schemaIds = listValidatableSchemaIds();
+  if (!Array.isArray(schemaIds) || schemaIds.some((schemaId) => typeof schemaId !== "string")) {
+    throw new TypeError("invokeFoundationMechanism: trusted Bundle validator index is unavailable");
+  }
+  const known = new Set(schemaIds);
+  for (const item of request.params.requests) {
+    if (!known.has(item.schemaId)) {
+      throw new ContractsError("SFC1002", `unknown schema $id: ${item.schemaId}`, { schemaId: item.schemaId });
+    }
+  }
+  return {
+    results: request.params.requests.map((item, inputIndex) => ({
+      inputIndex,
+      schemaId: item.schemaId,
+      result: validateBySchemaId(item.schemaId, item.document),
+    })),
+  };
+}
+
+export async function invokeFoundationMechanism(request, { validateBySchemaId, listValidatableSchemaIds } = {}) {
   if (request === null || typeof request !== "object" || Array.isArray(request)) {
     throw new TypeError("invokeFoundationMechanism: request must be an object");
   }
@@ -530,6 +572,9 @@ export async function invokeFoundationMechanism(request, { validateBySchemaId }
   if (params === null || typeof params !== "object" || Array.isArray(params)) {
     throw new TypeError("invokeFoundationMechanism: params must be an object");
   }
+  if (operation === "validate-many-by-schema-id") {
+    return invokeValidationBatch(request, { validateBySchemaId, listValidatableSchemaIds });
+  }
   if (operation === "validate-by-schema-id") {
     if (typeof validateBySchemaId !== "function") {
       throw new TypeError("invokeFoundationMechanism: validate-by-schema-id requires the trusted Bundle validator");

package/package.json

@@ -10,7 +10,7 @@
   "dependencies": {
     "@pnpm/lockfile.fs": "1001.1.35",
     "ipaddr.js": "2.5.0",
-    "skill-family-contracts": "0.8.3",
+    "skill-family-contracts": "0.9.0",
     "yaml": "2.9.0"
   },
   "description": "Thin Node.js mechanism runtime for Skill Family engineering contracts.",
@@ -21,7 +21,8 @@
   "exports": {
     ".": "./src/index.mjs",
     "./candidate/quickstart-profile": "./candidate/quickstart-profile.mjs",
-    "./candidate/rename-directory-no-replace": "./candidate/rename-directory-no-replace/rename-directory-no-replace.mjs"
+    "./candidate/rename-directory-no-replace": "./candidate/rename-directory-no-replace/rename-directory-no-replace.mjs",
+    "./fixed-set-publication": "./src/fixed-set-publication.mjs"
   },
   "files": [
     "src",
@@ -45,7 +46,7 @@
     "url": "https://github.com/ifoohoo/skill-family-harness-node.git"
   },
   "type": "module",
-  "version": "0.8.3",
+  "version": "0.9.0",
   "scripts": {
     "check": "node --test",
     "test": "node --test"

package/release-notes/0.8.4.yaml

@@ -0,0 +1,17 @@
+version: 0.8.4
+date: 2026-08-24
+locales:
+  en:
+    summary: Lockstep Foundation 0.8.4 version update with no new Harness mechanism or public API.
+    changes:
+      changed:
+        - Moves the package version to 0.8.4 together with Contracts and Engineering Kit.
+        - Keeps all 21 Harness capabilities and public exports unchanged; source-authority receipt validation belongs to Contracts.
+    upgradeNotes: Consumers must pin all three Foundation packages to exactly 0.8.4. No Harness API migration is required.
+  zh-CN:
+    summary: 随 Foundation 0.8.4 锁步升版；Harness 不新增机制或公共 API。
+    changes:
+      changed:
+        - 包版本与 Contracts、Engineering Kit 一同升至 0.8.4。
+        - 21 项 Harness 能力与公共导出保持不变；source-authority receipt 校验归 Contracts。
+    upgradeNotes: 消费者必须把三个 Foundation 包精确锁定到 0.8.4；Harness API 无需迁移。

package/release-notes/0.9.0.yaml

@@ -0,0 +1,23 @@
+version: 0.9.0
+date: 2026-08-24
+locales:
+  en:
+    summary: Harness 0.9.0 adds stable identity-bound reads and fixed-set no-replace publication with a fixed four-platform native closure.
+    changes:
+      added:
+        - Adds createFilesystemRootBinding and readFileBound with handle-relative no-follow acquisition and optional byte digest guarding.
+        - Adds the stable fixed-set-publication subpath with native no-replace publication and terminal indeterminate receipts.
+        - Adds the candidate validate-many-by-schema-id mechanism to the existing Quickstart dispatcher.
+      changed:
+        - Keeps protected deletion excluded and preserves the existing 21-item capability registry.
+    upgradeNotes: Pin Contracts, Harness, and Engineering Kit to exactly 0.9.0. Batch validation and the Quickstart Bundle remain candidate; filesystem binding and fixed-set publication are stable.
+  zh-CN:
+    summary: Harness 0.9.0 新增稳定身份绑定读取与固定集合不替换发布，并携带固定四平台原生闭包。
+    changes:
+      added:
+        - 新增 createFilesystemRootBinding 与 readFileBound，使用句柄相对不跟随符号链接获取，并支持可选字节摘要保护。
+        - 新增稳定 fixed-set-publication 子路径，使用原生不替换发布并保留终态 indeterminate 回执。
+        - 在既有 Quickstart dispatcher 中增加 validate-many-by-schema-id candidate 机制。
+      changed:
+        - 身份保护删除继续排除，既有 21 项能力登记保持不变。
+    upgradeNotes: 三个 Foundation 包必须精确锁定 0.9.0。批量校验与 Quickstart Bundle 仍为 candidate；文件系统绑定与固定集合发布为 stable。

package/src/bound-read.mjs

@@ -0,0 +1,241 @@
+import { constants as FS_CONSTANTS } from "node:fs";
+import { lstat, open, realpath } from "node:fs/promises";
+import path from "node:path";
+import process from "node:process";
+import { digestDocument } from "skill-family-contracts";
+import { digestBytes } from "./closure.mjs";
+import { HARNESS_ERROR_KINDS, HarnessError, mechanismError } from "./errors.mjs";
+import { loadNativeBoundReadAddon } from "./native/loader.mjs";
+
+const SHA256_PATTERN = /^[0-9a-f]{64}$/u;
+const ROOT_BINDING_KIND = "trusted-filesystem-root-binding";
+const ROOT_BINDING_BASIS = "canonical-realpath-device-inode-type-mode-v1";
+
+function supportedPlatform() {
+  if (process.platform === "darwin" && ["arm64", "x64"].includes(process.arch)) {
+    return true;
+  }
+  if (process.platform === "linux" && ["arm64", "x64"].includes(process.arch) &&
+      typeof process.report?.getReport?.()?.header?.glibcVersionRuntime === "string") {
+    return true;
+  }
+  return false;
+}
+
+function assertSupportedPlatform() {
+  if (!supportedPlatform()) {
+    throw mechanismError(
+      HARNESS_ERROR_KINDS.UNSUPPORTED_PLATFORM,
+      "bound filesystem reads are unsupported on this runtime",
+    );
+  }
+}
+
+function assertCanonicalAbsolute(value, label) {
+  if (typeof value !== "string" || !path.isAbsolute(value) ||
+      value.includes("\\") || value.includes("\0") || path.normalize(value) !== value) {
+    throw new TypeError(`${label} must be a normalized absolute path`);
+  }
+}
+
+function assertRootBindingShape(binding) {
+  if (binding === null || typeof binding !== "object" || Array.isArray(binding) ||
+      Object.keys(binding).sort().join(",") !== "basis,digest,digestAlgorithm,kind" ||
+      binding.kind !== ROOT_BINDING_KIND ||
+      binding.digestAlgorithm !== "sha256" ||
+      binding.basis !== ROOT_BINDING_BASIS ||
+      typeof binding.digest !== "string" || !SHA256_PATTERN.test(binding.digest)) {
+    throw new TypeError("rootBinding is not a filesystem-root-binding value");
+  }
+}
+
+function identityFromStats(stats) {
+  return {
+    type: "directory",
+    mode: Number(stats.mode & 0o777n),
+    device: String(stats.dev),
+    inode: String(stats.ino),
+  };
+}
+
+function makeBinding(canonicalPath, identity) {
+  return Object.freeze({
+    kind: ROOT_BINDING_KIND,
+    digestAlgorithm: "sha256",
+    basis: ROOT_BINDING_BASIS,
+    digest: digestDocument({
+      canonicalRealpath: canonicalPath,
+      device: identity.device,
+      inode: identity.inode,
+      mode: identity.mode,
+      type: identity.type,
+    }),
+  });
+}
+
+function openFlags(directory) {
+  const noFollow = FS_CONSTANTS.O_NOFOLLOW;
+  if (noFollow === undefined || FS_CONSTANTS.O_DIRECTORY === undefined) {
+    throw mechanismError(
+      HARNESS_ERROR_KINDS.UNSUPPORTED_PLATFORM,
+      "bound filesystem reads require O_NOFOLLOW and O_DIRECTORY",
+    );
+  }
+  return FS_CONSTANTS.O_RDONLY | noFollow | (directory ? FS_CONSTANTS.O_DIRECTORY : 0) |
+    (FS_CONSTANTS.O_CLOEXEC ?? 0);
+}
+
+function mapOpenFailure(cause, relPath, label) {
+  if (cause instanceof HarnessError) throw cause;
+  if (cause?.code === "ELOOP") {
+    throw mechanismError(
+      HARNESS_ERROR_KINDS.UNSAFE_STATE_ENTRY,
+      `${label} became a symbolic link during bound read`,
+      { input: relPath },
+    );
+  }
+  if (cause?.code === "ENOENT" || cause?.code === "ENOTDIR") {
+    throw mechanismError(
+      HARNESS_ERROR_KINDS.MISSING_RESOURCE,
+      `${label} does not exist during bound read`,
+      { input: relPath },
+    );
+  }
+  throw mechanismError(
+    HARNESS_ERROR_KINDS.READ_FAILED,
+    `${label} could not be opened: ${cause?.code ?? "unknown"}`,
+    { input: relPath },
+  );
+}
+
+async function captureRoot(root) {
+  assertCanonicalAbsolute(root, "root");
+  let before;
+  try {
+    before = await lstat(root, { bigint: true });
+  } catch (cause) {
+    throw mechanismError(HARNESS_ERROR_KINDS.INVALID_ROOT, "root cannot be inspected", {
+      code: cause?.code,
+    });
+  }
+  if (before.isSymbolicLink() || !before.isDirectory()) {
+    throw mechanismError(HARNESS_ERROR_KINDS.INVALID_ROOT, "root must be one real directory");
+  }
+  let canonical;
+  try {
+    canonical = await realpath(root);
+  } catch (cause) {
+    throw mechanismError(HARNESS_ERROR_KINDS.INVALID_ROOT, "root canonical path cannot be resolved", {
+      code: cause?.code,
+    });
+  }
+  if (canonical !== root) {
+    throw mechanismError(HARNESS_ERROR_KINDS.INVALID_ROOT, "root must already be its canonical realpath");
+  }
+  let handle;
+  try {
+    handle = await open(canonical, openFlags(true));
+  } catch (cause) {
+    mapOpenFailure(cause, "", "root");
+  }
+  try {
+    const opened = await handle.stat({ bigint: true });
+    if (!opened.isDirectory() || opened.dev !== before.dev || opened.ino !== before.ino ||
+        opened.mode !== before.mode) {
+      throw mechanismError(HARNESS_ERROR_KINDS.UNSAFE_STATE_ENTRY, "root identity changed during capture");
+    }
+    return { canonical, identity: identityFromStats(opened), handle };
+  } catch (cause) {
+    await handle.close();
+    throw cause;
+  }
+}
+
+export async function createFilesystemRootBinding(root) {
+  assertSupportedPlatform();
+  const captured = await captureRoot(root);
+  try {
+    return makeBinding(captured.canonical, captured.identity);
+  } finally {
+    await captured.handle.close();
+  }
+}
+
+function assertRelativePath(relPath) {
+  if (typeof relPath !== "string" || relPath.length === 0 || relPath.includes("\0") ||
+      relPath.includes("\\") || path.posix.isAbsolute(relPath)) {
+    throw mechanismError(HARNESS_ERROR_KINDS.INVALID_PATH, "bound read path is not a contained relative path");
+  }
+  const segments = relPath.split("/");
+  if (segments.some((segment) => segment.length === 0 || segment === "." || segment === "..")) {
+    throw mechanismError(HARNESS_ERROR_KINDS.PATH_TRAVERSAL, "bound read path contains an unsafe segment");
+  }
+  if (segments.some((segment) => /^[A-Za-z]:/u.test(segment))) {
+    throw mechanismError(HARNESS_ERROR_KINDS.WINDOWS_DRIVE_PATH, "bound read path contains a drive path");
+  }
+  return segments;
+}
+
+export async function readFileBound(root, relPath, { rootBinding, encoding, expectedSha256 } = {}) {
+  assertSupportedPlatform();
+  assertCanonicalAbsolute(root, "root");
+  assertRelativePath(relPath);
+  assertRootBindingShape(rootBinding);
+  if (encoding !== undefined && encoding !== "utf8") {
+    throw new TypeError('readFileBound: encoding must be "utf8" or undefined');
+  }
+  if (expectedSha256 !== undefined &&
+      (typeof expectedSha256 !== "string" || !SHA256_PATTERN.test(expectedSha256))) {
+    throw new TypeError("readFileBound: expectedSha256 must be a lowercase sha256 hex digest");
+  }
+
+  const segments = relPath.split("/");
+  const captured = await captureRoot(root);
+  try {
+    const currentBinding = makeBinding(captured.canonical, captured.identity);
+    if (currentBinding.digest !== rootBinding.digest) {
+      throw mechanismError(
+        HARNESS_ERROR_KINDS.UNSAFE_STATE_ENTRY,
+        "approved root binding does not match the current root",
+      );
+    }
+    const { addon } = await loadNativeBoundReadAddon();
+    const native = addon.readFileBoundNative(captured.canonical, segments);
+    if (!native?.ok) {
+      const cause = {
+        code: native?.errorCode === (process.platform === "darwin" ? 62 : 40) ? "ELOOP" : native?.errorCode === 2 ? "ENOENT" :
+          native?.errorCode === 20 ? "ENOTDIR" : `errno-${native?.errorCode ?? "unknown"}`,
+      };
+      if (cause.code === "ENOTDIR" && segments.length > 1) {
+        throw mechanismError(HARNESS_ERROR_KINDS.UNSAFE_STATE_ENTRY, "an intermediate component is not a real directory", {
+          input: relPath,
+        });
+      }
+      mapOpenFailure(cause, relPath, segments.length > 1 ? "bound path" : "leaf");
+    }
+    if (native.rootDevice !== captured.identity.device || native.rootInode !== captured.identity.inode ||
+        Number(native.rootMode) !== captured.identity.mode) {
+      throw mechanismError(HARNESS_ERROR_KINDS.UNSAFE_STATE_ENTRY, "root identity changed during bound read", {
+        input: relPath,
+      });
+    }
+    const bytes = Buffer.from(native.bytes);
+    const sha256 = digestBytes(bytes);
+    if (expectedSha256 !== undefined && sha256 !== expectedSha256) {
+      throw mechanismError(
+        HARNESS_ERROR_KINDS.CONTENT_GUARD_REJECTED,
+        "bound read digest differs from the expected frozen digest",
+        { input: relPath, expectedSha256, actualSha256: sha256 },
+      );
+    }
+    return Object.freeze({
+      path: path.join(captured.canonical, ...segments),
+      content: encoding === "utf8" ? bytes.toString("utf8") : bytes,
+      sha256,
+      bytes: bytes.length,
+      mode: Number(native.leafMode),
+    });
+  } finally {
+    await captured.handle.close().catch(() => {});
+  }
+}

package/src/errors.mjs

@@ -42,6 +42,7 @@ export const HARNESS_ERROR_KINDS = Object.freeze({
   WORKSPACE_DISPOSED: "workspace-disposed",
   CLOSURE_CONFLICT: "closure-conflict",
   UNSUPPORTED_POLICY: "unsupported-policy",
+  UNSUPPORTED_PLATFORM: "unsupported-platform",
   EXECUTION_FAILED: "execution-failed",
   INVALID_RESULT: "invalid-result",
   STORE_CLOSED: "store-closed",

package/src/fixed-set-publication-loader.mjs

@@ -0,0 +1,5 @@
+import { loadNativeBoundReadAddon } from "./native/loader.mjs";
+
+export async function loadNativeAddon() {
+  return loadNativeBoundReadAddon();
+}