P8: Protocol Kernel & Runtime Retirement (#56)

* w1.1: freeze 5 must-freeze schemas (P8 protocol kernel)

current_handoff: remove 4 runtime provenance fields from top-level
properties; plan_id non-null string. plan_md_sections: prefixItems for
ordered section validation. active_plan: plan_id naming convention
documented. plan_receipt: receipt_id logical ID clarified.
history_receipt: parsed-structure-not-raw-markdown clarified.

* w1.2: rewrite protocol.md §2/§6/§8 for P8 post-cutover

§2: plan.md unique semantic entry + 3-tier progressive disclosure +
8 required sections + receipts conditional. §6: Verifier read-only
contract (MUST NOT write state/plan/blueprint) + EAR [RETIRED in P8].
§8: replaced Deep Host runtime protocol with Host Protocol Entry
Contract (request admission, 4-step read order, read budget, receipts
latest-only, write-back boundary, fail-open, 2-file state index).
Added Reader Contract (3-line audience targeting).

* w1.3: define host prompt protocol entry spec + sync task status

Add host-prompt-protocol-entry.md: content spec for P8-aware host
prompt (request admission, 4-step entry, read budget, writer boundary,
fail-open, forbidden surfaces). Update protocol.md Reader Contract
wording (tooling author, on-demand reading). Check off W1.1/W1.2/W1.3
tasks in tasks.md.

* w1.4+w1.5: plan package sections spec + registry retirement contract

W1.4: plan_snapshot schema description clarified (not independent
carrier, not machine truth, does not override plan.md body or receipts).
3-tier plan package, 8 required sections, receipts conditional rules
already in protocol.md §2 (W1.2). W1.5: _registry.yaml [DEPRECATED by
P8] added to protocol.md §8.9 with compliance smoke MUST fail rule.
design.md §4.3 already records deletion rationale.

* w1.5b: blueprint interim sync — authorization narrowing + legacy retirement

ADR-013: add P8 Scope Clarification (authorization narrowing, EAR
retirement, convergence chain update; title unchanged).
ADR-017: EAR [SUPERSEDED by P8] on title + status + body + ✅ line.
design.md: convergence chain authorize→record evidence; Core State
Files 6→2 + legacy mapping; persistence red-line active 2-file +
legacy mapping; 对外承诺分层 EAR retired; 外部消费面 EAR +
gate_receipt retired; 宿主能力治理 hard disclaimer; Validator
wording narrowed (2 locations); Convention/Runtime mode legacy markers.
protocol.md: §3 Runtime mode column [RETIRED in P8] + 6 cells
struck through; §6 header EAR removed from normative exception;
统一出口表 receipt→过程审计回执; §3/§4/§5 Validator prose
updated to compliance smoke + sopify_writer.
tasks.md: W1.5b checkboxes synced.

* w1.6-w1.7: protocol check and wave 1 gate

* w2.0: plan doc closure — catalog relocation + CI/prompt audit + W2 task expansion

Add W2.0a/W2.0b/W2.2b/W2.3b/W2.3c pre-flight tasks before runtime deletion.
New §9b in design.md: catalog relocation decision, payload resource positioning,
file migration table, field cleanup (runtime_entry/entry_kind/supports_routes).
Update §9 keep-list/migration-list and §14 risk table with 3 new risks.

* w2.0a: snapshot registry lifecycle before retirement

Export 4 registry entries (1 deferred, 1 completed, 2 archived) to
assets/registry-lifecycle-snapshot.md. Includes human-readable table,
summary, and original field schema reference.

* w2.0b: catalog relocation + generator runtime-free

Migrate builtin skill catalog from runtime/ to skills/catalog/:
- YAML sources: runtime/builtin_skill_packages/ → skills/catalog/<id>/skill.yaml
- Generated JSON: runtime/ → skills/catalog/builtin_catalog.generated.json
- Schema: runtime/skill_schema.py → sopify_contracts/skill_schema.py
- YAML loader: runtime/_yaml.py → scripts/_yaml_subset.py (load only, no dump)
- Generator: runtime-free imports + new paths
- Remove runtime_entry, entry_kind, supports_routes from schema + JSON + YAML
- Narrow SKILL_MODES to (advisory, workflow) and SKILL_PERMISSION_MODES to (default, host)
- Update CI drift check (ci.yml + release-preflight.sh) paths
- Update header templates: new path + remove runtime engine language
- Update golden-snapshots.json hashes for changed header templates

* w2.1: decouple minimal cli inspection from runtime

* w2.2+w2.2b: decouple installer core from runtime + catalog payload resource

- sopify_bundle.py: remove runtime directory/scripts/manifest import;
  rename sync_runtime_bundle→sync_payload_bundle; inline manifest writer
  with capabilities field; add catalog file copy from skills/catalog/
- payload.py: rename _install_versioned_runtime_bundle→_install_versioned_payload_bundle;
  remove runtime_gate/runtime_entry_guard capabilities; .sopify-runtime→.sopify-payload;
  catalog_path in payload-manifest.json uses payload_root-relative path
- validate.py: remove 4 runtime paths from expected_bundle_paths; add catalog
- bootstrap_workspace.py: remove 4 runtime files from _REQUIRED_BUNDLE_FILES; add catalog;
  .sopify-runtime→.sopify-payload in ignore entries and fallback defaults
- models.py: remove FeatureId.RUNTIME_GATE, PREFERENCES_PRELOAD, SMOKE_VERIFIED
- hosts/codex+claude: remove retired features from declared/verified; clean doctor_checks
- inspection.py: remove preferences_preload from dataclass+all construction sites;
  _inspect_smoke always returns CHECK_SKIP; doctor_checks() no longer includes smoke
- install_sopify.py: remove run_bundle_smoke_check import and invocation
- test_installer.py: rename function+patch targets to match W2.2 renames
- Plan docs: W2.2+W2.2b marked done; blueprint focus→P8; registry entry added;
  preferences_preload retirement note in design.md persistence red-line

* w2.3: rename canonical_writer → sopify_writer + scope public API

- git mv canonical_writer/ → sopify_writer/ (6 files)
- __init__.py: remove StateStore/SESSIONS_DIRNAME/normalize_session_id from
  public __all__; only iso_now remains as public export; docstring updated to
  "the writer for Sopify protocol state and receipts"
- store.py: observability string "canonical_writer" → "sopify_writer" (2 sites)
- All runtime/ imports (14 files): StateStore → sopify_writer.store;
  iso_now stays at sopify_writer top level
- installer/: _DIRECTORY_ASSETS, expected_bundle_paths, _REQUIRED_BUNDLE_FILES
  all updated to sopify_writer
- scripts/ + tests/: imports and string literals updated
- sopify_contracts/__init__.py: docstring reference updated
- Plan docs: W2.3 marked done with Note on StateStore demotion;
  W2.3b wording fixed; snapshot updated to W2.3b next

* w2.3b: detach CI hard gate from runtime smoke

CI hard gate now uses an explicit non-runtime test set (84 tests)
until W2.7 reclassifies runtime-coupled tests.

- Rename runtime-tests → protocol-tests job
- Replace check-bundle-smoke + check-prompt-runtime-gate-smoke steps
  with sopify_protocol_check (3 scenarios)
- Switch from marker-based to explicit test file list
- Rewrite payload smoke: runtime entry assertions → catalog_path check
- Sync release-preflight.sh with CI structure
- Roll back header version to 2026-05-31.142150 + update golden snapshots

Context-Checkpoint: A

* w2.3c: cutover host prompt + skill sources from runtime-first to protocol-first

Replace runtime gate / sopify_runtime / go_plan_runtime references in
tracked source templates (zh + en) with protocol-first entry language:
request admission, 4-step entry order, sopify_writer write boundary.

- Header templates: 3 runtime-first notes → protocol-first (zh + en)
- Design rules: runtime helper boundary section → protocol entry boundary
- Analyze/Design/Develop/KB skill files: remove runtime routing refs
- Golden snapshots regenerated for updated managed block
- tasks.md: sopify_protocol_check scoped as CI/preflight, not host prompt

* w2.4: migrate StateStore to P8 2-file model (A-lite)

sopify_writer now only writes active_plan.json and current_handoff.json.
All legacy state file writers (current_run, current_plan, current_clarification,
current_decision, current_archive_receipt, last_route) removed.

- store.py: rewrite to 2-file model, constructor takes Path not RuntimeConfig,
  session-scoped writes removed
- handoff.py: RuntimeHandoff aligned with P8 schema — route_name, run_id,
  handoff_kind, resolution_id removed from top-level fields
- invariants.py: legacy validators removed, only InvariantViolationError retained
- __init__.py: docstring updated — StateStore is P8 protocol writer, not
  temporary runtime shim

Runtime code is now broken at import level (expected, A-lite).
W2.7/W2.10 will clean up runtime code and tests.

* w2.5: fold clarification/decision into handoff artifacts

Clarification and decision state no longer need separate state files.
They are expressed via current_handoff.json:
- required_host_action=answer_questions + artifacts.questions
- required_host_action=confirm_decision + artifacts.decision_options

- protocol_check: add artifact convention validation with isinstance
  guard for non-dict artifacts (fail-closed, no crash)
- Add clarification_pending and decision_pending compliance fixtures
- Wire both fixtures into CI and release-preflight protocol smoke steps
- tasks.md: W2.5 marked complete; plan.md snapshot updated

Context-Checkpoint: A

* w2.6: retire registry chain — hard removal of _registry.yaml and plan registry

The plan registry (_registry.yaml + runtime/plan/registry.py) served as a
machine-readable plan index/priority table. P8 replaces it with the 2-file
protocol state model (active_plan.json + current_handoff.json).

Deleted:
- .sopify-skills/plan/_registry.yaml (data file, 5 entries)
- runtime/plan/registry.py (955 lines)
- tests/test_runtime_plan_registry.py (301 lines)

Cleaned:
- runtime/engine.py: removed registry import, _registry_file_should_be_reported
- runtime/_planning.py: removed upsert_plan_entry, simplified _created_plan_notes
- runtime/output.py: removed _priority_note helper and 2 call sites
- runtime/archive_lifecycle.py: removed remove_plan_entry, registry_updated/notes
- runtime/manifest.py: removed plan_registry capability flags
- runtime/_yaml.py: removed dump_yaml/is_yaml_scalar/yaml_scalar (registry-only)
- tests/runtime_test_support.py: removed 7 registry re-exports
- tests/test_runtime_engine.py: removed 2 capability assertions
- installer/bootstrap_workspace.py: removed _registry.yaml from ignore entries
- docs/how-sopify-works.md/.en.md: removed _registry.yaml from tree + description
- skills/{zh,en}/header.md.template: removed _registry.yaml from tree
- .gitignore: removed _registry.yaml ignore rule
- .sopify-skills/project.md: removed registry cleanup instruction

Retained: sopify_protocol_check.py _registry.yaml forbidden guard (P8 gate).

* w2.7: reclassify tests — retire runtime mirrors, anchor protocol/writer/installer

Delete 20 runtime behavior-mirror tests (~11.2K LOC) and runtime_test_support.py
import hub. Surgically fix test_installer.py (remove runtime imports, switch
gate-first assertions to protocol-first, retire runtime_gate capability),
test_installer_status_doctor.py (bundle loops → protocol-kernel assets only,
retire smoke_verified/preferences_preload), test_release_hooks.py (fixture
paths → installer/payload.py + sopify_contracts/__init__.py, governance scope
for checkpoint tests, legacy state → current_handoff.json). Delete
test_installer_validate.py (bundle smoke only), conftest.py (implementation_mirror
marker retired), fixtures/p4d_smoke/ + sample_invariant_gate_matrix.yaml.

Add tests/test_sopify_writer.py (12 tests): StateStore 2-file invariants,
handoff round-trip + observability injection, retired state file guard.

163 passed / 0 failed. rg runtime imports in tests/ → 0 hits.

Context-Checkpoint: C

* w2.8: delete runtime entry/smoke scripts + clean validate.py + fix doc references

Delete scripts/runtime_gate.py, scripts/sopify_runtime.py,
scripts/check-prompt-runtime-gate-smoke.py, scripts/check-bundle-smoke.sh.
Clean installer/validate.py: remove run_bundle_smoke_check() + 5 private
helpers + smoke-only imports (os/shlex/subprocess). Fix handoff-first label
in distribution.py and inspection.py from runtime to protocol. Replace
CONTRIBUTING.md/CN Runtime Bundle sections with Payload Bundle sections and
swap validation commands to protocol/payload smoke. Update
skill-standards-refactor.md runtime-first to protocol-first.

Keep installer/sopify_bundle.py (now protocol-kernel syncer, imported by
payload.py). Keep check-install-payload-bundle-smoke.py (payload smoke, CI).

163 passed / 0 failed. Protocol smoke PASS. Payload smoke PASS.

Context-Checkpoint: C

* w2.9: reclassify protocol-verified hosts — DEEP_VERIFIED → PROTOCOL_VERIFIED

Rename SupportTier.DEEP_VERIFIED to PROTOCOL_VERIFIED across 5 files:
installer/models.py (enum), installer/hosts/{codex,claude}.py (tier ref),
scripts/check-enhancement-declaration.py (governance expectations + warning),
tests/test_installer_status_doctor.py (assertion strings).

Preserve Codex/Claude adapters, 5 verified_features, 3 declared_enhancements.
PROTOCOL_VERIFIED covers protocol entry + payload + bootstrap + handoff-first;
does not imply receipt/finalize write API (W2.9b/W3 scope).

Rewrite plan.md/tasks.md W2.9 section: "Remove Deep Host Adapters" →
"Reclassify Protocol-Verified Hosts" with boundary note.

163 passed / 0 failed. rg deep_verified in installer/scripts/tests → 0 hits.

* w2.10: delete runtime/ directory (46 files / ~15.6K LOC)

Remove entire runtime/ directory — the pre-P8 runtime kernel is no longer
needed after protocol-kernel cutover (sopify_writer + sopify_contracts).

Fix CONTRIBUTING.md/CN: remove dead runtime/builtin_skill_packages/ path,
replace runtime/skill_schema.py with sopify_contracts/skill_schema.py,
remove "unless runtime explicitly enforces" wording.

Fix sopify_writer/_resume.py docstring: "stays in runtime" →
"retired with runtime/".

Add W3.6 governance residual tracking: Plan A checkpoint scope cleanup,
pre-commit dead patterns, CONTRIBUTING hook description.

163 passed / 0 failed. Protocol smoke PASS. runtime/ confirmed absent.

Context-Checkpoint: C

* w2.11: ProtocolStore — writer finalize API + boundary validation

Rename StateStore → ProtocolStore(sopify_root): unified write entry for
protocol state, receipts, and finalize operations under .sopify-skills/.

New API (all keyword-only):
- write_plan_receipt: receipt_id pattern validation, plan_id/receipt_id
  conflict detection, auto-injects timestamp + provenance
- write_history_receipt: Markdown rendering, outcome/summary/key_decisions
  validation, defaults month to current UTC YYYY-MM
- finalize_plan: writes receipts/final.json + history receipt.md + clears
  active_plan/current_handoff state

Boundary validation added:
- set_active_plan rejects empty plan_id
- write_plan_receipt rejects empty plan_id
- key_decisions rejects any empty item (all non-empty, not just any)

Export ProtocolStore + InvariantViolationError from sopify_writer package.

33 writer tests (30 + 3 boundary). 184 passed / 0 failed full suite.
Protocol smoke 3 scenarios PASS.

* wave-2-gate: pass verification + close W2 wave

Wave 2 Gate: 5/5 checks passed (runtime absent, registry absent,
no active runtime imports, protocol 3 scenarios PASS, 184 tests green).

Update plan/tasks status: W2 complete, W3 Qoder Host Proof next.
Fix W2.11 test counts (33 writer / 184 total after boundary fixes).
Update blueprint README focus line to reflect Gate passed.
Add lightweight audit note: independent audit accepted, residuals
assigned to W3.5/W3.6.

* phase-0: pre-flight cleanup — purge stale state, dead governance chain, rewrite project.md

Phase 0 of P8 Wave 3: eliminate contradictions between post-P8 2-file
state model and residual pre-P8 artifacts before Qoder host proof.

State cleanup: delete 4 legacy state files + sessions/ directory (121
entries). Only current_handoff.json remains; active_plan.json pending
next managed plan creation.

Dead governance chain removal (atomic): delete check-context-checkpoints.py
+ test_context_checkpoints.py; clean references from .githooks/commit-msg,
.github/workflows/ci.yml, scripts/release-preflight.sh, tests/test_release_hooks.py,
CONTRIBUTING.md, CONTRIBUTING_CN.md.

project.md rewrite: §Runtime 实现与测试约定 → §Protocol Kernel 实现与测试约定;
Develop 质量约定 updated (develop_callback_runtime.py retired).

Plan package docs reconciliation: design.md §9 delete-list corrected
(sopify_bundle.py + codex/claude adapters kept), §10 Host Proof updated,
§11 rewritten (Qoder PROTOCOL_VERIFIED home-scope hybrid, 5-point
full-capability criteria). plan.md Wave 3 restructured with Phase 0 +
updated W3.1-W3.3 + Key Decisions #19-23. tasks.md Phase 0 P0.1-P0.6
added and completed, Wave 3 Gate updated to 5+2 criteria.

Tests: 180 passed / 0 failed. Protocol smoke: 3/3 PASS.

* w3.1: Qoder PROTOCOL_VERIFIED host adapter — home-scope hybrid

Register Qoder as the 4th official PROTOCOL_VERIFIED host alongside
Codex and Claude. Home-scope hybrid adapter installs to ~/.qoder/
(AGENTS.md + sopify/ payload), with bare --target qoder support via
default_language="zh-CN".

New files:
- installer/hosts/qoder.py (adapter + capability declaration)

Modified:
- installer/hosts/__init__.py: register QODER_HOST
- skills/hosts.yaml: add Qoder metadata
- installer/distribution.py: add Qoder display name
- installer/inspection.py: _recommend_target helper for bare/explicit
  --target in doctor/status recommendations
- skills/{zh,en}/header.md.template: add Qoder column to tool mapping
- tests/golden-snapshots.json: regenerated (shared template change)
- tests/test_installer_status_doctor.py: host set 3→4 + qoder
  capability contract test (PROTOCOL_VERIFIED, 5 features,
  3 enhancements, adapter properties)

Plan package: Phase 0 + W3.1 status reconciliation.

181 passed / 0 failed. Protocol smoke: 3/3 PASS.

* w3.2+w3.3: Qoder proof package — installed payload writer + durable transcript

W3.2 (installed payload capability proof):
- sopify_writer importable from ~/.qoder/sopify/bundles/0.0.0-dev/
- ProtocolStore API writes active_plan + handoff + receipts + finalize
- No repo-local sys.path hack, no thin wrapper needed

W3.3 (durable end-to-end proof transcript):
- scripts/w33_qoder_proof.py: reproducible proof script (15/15 PASS)
- assets/w33-proof-transcript.md: persistent audit artifact
- Session A → Session B → Finalize full chain verified
- Scope: writer-level proof; LLM behavioral proof out of scope

Plan package: W3.4 canonical root rename (.sopify-skills → .sopify)
added with 6 sub-tasks + two-layer gate. Key Decision #24.

* w3.4: canonical protocol root fixed to .sopify; configurable root removed

Hard cutover from .sopify-skills to .sopify as the single canonical
protocol root directory. No dual-path compatibility, no migration
shim, no fallback to old directory name.

Key decisions:
- Canonical root = .sopify (fixed, not configurable)
- plan.directory config field removed from sopify_contracts/core.py
  RuntimeConfig; runtime_root now hardcodes ".sopify"
- plan.directory removed from all public surfaces: README (en/zh),
  header templates (en/zh), copilot-instructions.md, examples config
- .gitignore patterns updated

Changes: ~481 replacements across ~64 files
- Implementation layer: installer/, scripts/, sopify_writer/ (51)
- Test layer: tests/, fixtures (37)
- Protocol + prompt + skill assets (171)
- User docs path rename only, no narrative rewrite (26)
- Physical directory: git mv .sopify-skills .sopify
- Plan package + blueprint + assets self-update (196)

Verification:
- 181 passed / 0 failed
- Protocol smoke 3/3 PASS
- Engineering gate: 0 .sopify-skills hits
- Consumption gate: 0 .sopify-skills hits
- plan.directory grep: 0 hits in all active surfaces
- install.sh --target qoder: success
- Lightweight continuation check: PASS

History: directory rename applied; historical content not rewritten.
Reports: unchanged (historical records).
W3.3 transcript: annotated with pre-rename execution note.

* w3.5: docs narrative cutover — protocol-first, user-friendly, post-P8 aligned

User-facing docs rewritten for clarity:
- README intro: "protocol layer" → "saves your AI development process"
- Architecture section: 4 bullets in plain language, no jargon
- Host support matrix: Codex/Claude/Qoder = PROTOCOL_VERIFIED, Copilot = BASELINE_SUPPORTED
- Directory structure: removed runtime/, added sopify_writer/ + sopify_contracts/

Architecture SVG regenerated (fireworks-tech-graph):
- 4 clean layers: Host → Protocol → Workflow → Knowledge
- User-friendly labels (Work Request, not ActionProposal)
- Qoder added to host layer
- Protocol State row with 2-file model + fail-open explanation

How-sopify-works (EN/ZH):
- Full rewrite: Core Value + Protocol Entry (4-step read chain) + 2-file state model
- "Runtime retired; workflow retained" narrative
- Harness PNG retirement note moved before image
- Fail-open behavior documented

Getting-started.md:
- Removed retired capabilities from sopify.json example
- state/ description: "protocol state, 2 files only"
- Qoder added to requirements

Supplementary fixes:
- README resume promise: "persist in git" not "auto-resume"
- Chinese README synchronized throughout
- Workflow SVGs: Runtime Gate → Protocol Entry, Checkpoint-gated → Checkpoint-based

181 passed / 0 failed.

* fix: rename missed test fixtures from .sopify-skills to .sopify

W3.4 rename missed tests/fixtures/clarification_pending/ and
tests/fixtures/decision_pending/. Both still used .sopify-skills/
causing protocol smoke continuation scenario to fail with
"Missing state/active_plan.json".

181 passed / 0 failed. Protocol smoke all scenarios PASS.

* w3.6: blueprint sync — post-P8 narrative alignment across all layers

Blueprint (design.md):
- Product positioning: "开发过程协议层" (development process protocol layer)
- 4-layer table: 用户层/产品层/能力层/架构层
- Convergence chain: produce→verify→record evidence→settle (final)
- Three-layer positioning: Protocol Kernel + Default Workflow + Host Adapters
- Core pipeline: Validator → protocol admission
- Runtime 五层架构: [RETIRED by P8]
- 宿主能力治理: full rewrite (convention_only / payload_capable / protocol_verified)
- 削减预算表: P8 Final with completion markers
- Hard constraints: updated to post-P8 terms
- Core contracts: Checkpoint/Archive/Runtime state scope → post-P8

ADR-013: P8 scope clarification → final
ADR-017: SUPERSEDED → RETIRED (all instances)

Protocol.md: P8 terminology mapping note, SUPERSEDED → RETIRED

Product docs:
- README: "development process protocol layer", tracked vs gitignored distinction
- README.zh-CN: synchronized
- Architecture SVG: regenerated with user-friendly labels, product slogans

Active governance:
- install.sh: "runtime" → "protocol kernel"
- .githooks/pre-commit: runtime/* → sopify_writer/* + sopify_contracts/*

Blueprint tasks.md:
- Runtime retirement Phase 2 marked done
- Protocol prose cleanup recorded as explicit future item
- Product direction principle updated

P8 plan package: W3.6 + Wave 3 Gate marked complete, status → Finalize

181 passed / 0 failed. Protocol smoke 3/3 PASS.

* finalize: P8 archived + protocol prose de-ambiguation

Finalize:
- F0: sopify.json — removed runtime_gate, workspace_kind → external
- F1: receipts/final.json — full evidence (6 keys)
- F2: Plan package archived to history/2026-06/, receipt.md enhanced,
      state cleared, history/index.md + blueprint/README.md updated
- F3: CHANGELOG.md entry under [Unreleased]

Protocol prose de-ambiguation (release polish):
- §2: state/ "runtime管理" → "sopify_writer管理, 2文件"
- §3/§4: Validator → protocol admission
- §6: EAR unified to [RETIRED by P8], Validator退场说明
- §7: Subject Identity消费方更新, Runtime消费边界标RETIRED,
      P8术语说明覆盖Validator MUST规则
- 非目标: runtime引用更新, state schema归sopify_writer
- 权限边界: Validator/runtime退场说明

Post-fix: docs/getting-started.md sopify.json expected output aligned

181 passed / 0 failed. Protocol smoke 3/3 PASS.

Author: Li-Sanze

.githooks/commit-msg

@@ -81,10 +81,5 @@ if [[ -f "$STATE_FILE" ]]; then
   upsert_trailer "$MESSAGE_FILE" "Release-Date" "$RELEASE_DATE"
 fi
 
-CHECKPOINT_SCRIPT="$ROOT_DIR/scripts/check-context-checkpoints.py"
-if [[ -f "$CHECKPOINT_SCRIPT" ]]; then
-  python3 "$CHECKPOINT_SCRIPT" commit-msg --root "$ROOT_DIR" --message-file "$MESSAGE_FILE"
-fi
-
 trap - EXIT
 cleanup

.githooks/pre-commit

@@ -83,10 +83,10 @@ trap on_exit EXIT
 is_release_relevant_file() {
   local path="$1"
   case "$path" in
-    runtime/*|installer/*|skills/*|README.md|README.zh-CN.md|CHANGELOG.md)
+    sopify_writer/*|sopify_contracts/*|installer/*|skills/*|README.md|README.zh-CN.md|CHANGELOG.md)
       return 0
       ;;
-    scripts/sopify_runtime.py|scripts/model_compare_runtime.py|scripts/check-bundle-smoke.sh|scripts/release-sync.sh|scripts/release-preflight.sh|scripts/sync-skills.sh|scripts/check-version-consistency.sh)
+    scripts/release-sync.sh|scripts/release-preflight.sh|scripts/sync-skills.sh|scripts/check-version-consistency.sh)
       return 0
       ;;
     *)

.github/workflows/ci.yml

@@ -16,7 +16,7 @@ jobs:
       - name: Check version consistency
         run: bash scripts/check-version-consistency.sh
 
-  runtime-tests:
+  protocol-tests:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
@@ -33,7 +33,7 @@ jobs:
         run: |
           tmp="$(mktemp)"
           python3 scripts/generate-builtin-catalog.py --output "$tmp" >/dev/null
-          python3 - runtime/builtin_catalog.generated.json "$tmp" <<'PY'
+          python3 - skills/catalog/builtin_catalog.generated.json "$tmp" <<'PY'
           import difflib
           import json
           from pathlib import Path
@@ -53,24 +53,32 @@ jobs:
               raise SystemExit(1)
           PY
 
-      - name: Check context checkpoints
-        run: python3 scripts/check-context-checkpoints.py repo --root .
-
-      - name: Run hard gate tests (contract + smoke + distribution)
+      - name: Run hard gate tests (protocol + smoke + distribution)
         run: |
           pip install --quiet pytest
-          python3 -m pytest tests -m "not implementation_mirror" -v
+          python3 -m pytest \
+            tests/protocol/test_convention_compliance.py \
+            tests/test_check_readme_links.py \
+            tests/test_distribution.py \
+            tests/test_golden_snapshots.py \
+            tests/test_release_hooks.py \
+            tests/test_sopify_init_smoke.py \
+            -v
+
+      - name: Run protocol smoke — new-plan
+        run: python3 scripts/sopify_protocol_check.py check --scenario new-plan --fixture tests/fixtures/minimal_plan
+
+      - name: Run protocol smoke — continuation
+        run: python3 scripts/sopify_protocol_check.py check --scenario continuation --fixture tests/fixtures/minimal_plan
 
-      - name: Run implementation-mirror tests (advisory)
-        if: always()
-        continue-on-error: true
-        run: python3 -m pytest tests -m "implementation_mirror" -v
+      - name: Run protocol smoke — continuation (clarification pending)
+        run: python3 scripts/sopify_protocol_check.py check --scenario continuation --fixture tests/fixtures/clarification_pending
 
-      - name: Run runtime smoke check
-        run: bash scripts/check-bundle-smoke.sh
+      - name: Run protocol smoke — continuation (decision pending)
+        run: python3 scripts/sopify_protocol_check.py check --scenario continuation --fixture tests/fixtures/decision_pending
+
+      - name: Run protocol smoke — finalize
+        run: python3 scripts/sopify_protocol_check.py check --scenario finalize --fixture tests/fixtures/minimal_plan
 
       - name: Run install/payload bootstrap smoke
         run: python3 scripts/check-install-payload-bundle-smoke.py
-
-      - name: Run prompt runtime gate smoke
-        run: python3 scripts/check-prompt-runtime-gate-smoke.py

.gitignore

@@ -8,9 +8,8 @@ __pycache__/
 
 .sopify-runtime/
 
-.sopify-skills/state/
-.sopify-skills/replay/
-.sopify-skills/plan/_registry.yaml
+.sopify/state/
+.sopify/replay/
 
 evals/skill_eval_report.json
 

.sopify-skills/blueprint/design.md

@@ -13,8 +13,9 @@
 ## 当前焦点
 
 <!-- sopify:auto:focus:start -->
-- 当前活动 plan：暂无。
-- history 归档：已可用；最近归档为 `../history/2026-06/20260529_pre_launch_consolidation`。
+- 当前活动 plan：无（P8 已归档）。
+- P8 Protocol Kernel & Runtime Retirement 已归档至 `../history/2026-06/20260605_p8_protocol_kernel_runtime_retirement`（runtime 删除 + canonical root .sopify + Qoder host proof + 蓝图全量对齐）。
+- history 归档：已可用；最近归档为 `../history/2026-06/20260605_p8_protocol_kernel_runtime_retirement`。
 <!-- sopify:auto:focus:end -->
 
 ## 深入阅读入口
@@ -27,5 +28,5 @@
 - [Sopify 宿主接入规范 (Protocol v0)](./protocol.md)
 - [Skill 标准对齐蓝图](./skill-standards-refactor.md)
 - [变更历史](../history/index.md)
-- 最近归档：`../history/2026-06/20260529_pre_launch_consolidation`
+- 最近归档：`../history/2026-06/20260605_p8_protocol_kernel_runtime_retirement`
 <!-- sopify:auto:read-next:end -->

.sopify-skills/plan/20260605_p8_protocol_kernel_runtime_retirement/tasks.md

@@ -15,11 +15,13 @@ Sopify 需要明确自身在 AI 编程生态中的定位，避免与宿主（Kir
 
 Sopify 官方在 core 之上提供轻量、可插拔、收敛式的 blueprint-driven workflow 作为默认产品体验。
 
+> **P8 Final Scope（2026-06）**：P8 后"Authorization"的含义已最终收窄。本 ADR 标题"Evidence & Authorization Layer"不改（不做品牌手术）。P8 后 Authorization 不再指 pre-execution side-effect approval（该职责退回宿主原生权限、sandbox、用户确认、工具审批）。Sopify 保留的 authorization 语义为：protocol admission（sopify_writer schema/contract 校验）、receipt validity（证据链完整性）、archive admission（归档准入）。ExecutionAuthorizationReceipt 作为 pre-execution authorization artifact 在 P8 已退场（详见 ADR-017 [RETIRED by P8]）。收敛链已确定为 produce → verify → record evidence → settle。
+
 Core 职责：
 
-1. **证据规范**：定义任务/方案/交接/归档事实的标准格式（`.sopify-skills/` 纯文件协议）
-2. **授权判定**：Validator 是唯一授权者——判定行动是否可执行、方案是否可归档
-3. **收据生成**：fail-closed 授权回执让每次决策可追溯、可审计
+1. **证据规范**：定义任务/方案/交接/归档事实的标准格式（`.sopify/` 纯文件协议）
+2. **协议准入**：sopify_writer 做结构级校验——判定写入是否符合协议格式、receipt 是否有效、归档是否完整
+3. **审计证据**：receipts 让每次决策可追溯、可审计
 4. **跨宿主接力**：handoff 机器契约让任务在不同 session/model/host 间精确恢复
 5. **知识沉淀**：跨任务可复用的稳定结论沉淀为 blueprint / history
 
@@ -57,13 +59,13 @@ Core + Default Workflow 之外的生产/验证/知识增强，归入 **Plugins /
 
 如果以上任一能力被宿主完全替代且无跨宿主可携带性需求，该能力应 sunset。
 
-**Feature intake gate**：每个新特性必须回答——它增强了哪项不可替代能力？是否扩大了 runtime surface？如果只在单宿主场景下有价值，不进 core。
+**Feature intake gate**：每个新特性必须回答——它增强了哪项不可替代能力？是否扩大了 protocol surface？如果只在单宿主场景下有价值，不进 core。
 
 ## 后果
 
-- Core（durable）只保留证据规范 / 授权判定 / 收据生成 / 合规验证 / 跨宿主接力契约
+- Core（durable）只保留证据规范 / 协议准入 / 审计证据 / 合规验证 / 跨宿主接力契约
 - Default Workflow 是 Core 之上的官方收敛式工作流，地位高于参考 demo，低于 Core
 - 具有独立用户价值的生产/验证/知识能力设计为外插 Plugins / Skills
 - CrossReview 是已实现的外插参考范本
-- Runtime 是参考实现，服务于 Default Workflow，不是 co-equal product
+- Runtime 已在 P8 中退场；protocol kernel（sopify_writer + sopify_contracts + protocol.md）是 post-P8 的真相源
 - Core promotion rule：只有影响跨宿主互操作、receipt validity、archive admissibility 的契约才进 Core