@aihq/harness 0.4.1 → 0.6.0

package/dist/cli.js

@@ -1,3 +1,4 @@
 #!/usr/bin/env node
-import{ja as s}from"./chunk-Z2VMMIMJ.js";s().parseAsync(process.argv).catch(r=>{process.stderr.write(`fatal: ${r instanceof Error?r.message:String(r)}
+import{qa as s,ra as e,sa as n}from"./chunk-PHJ6DL2Y.js";e(process.argv)?s().parse(process.argv):n().then(({program:r,warnings:o})=>{for(let i of o)process.stderr.write(`aih: plugin: ${i}
+`);return r.parseAsync(process.argv)}).catch(r=>{process.stderr.write(`fatal: ${r instanceof Error?r.message:String(r)}
 `),process.exitCode=1});

package/dist/index.d.ts

@@ -186,7 +186,7 @@ type Verdict = "pass" | "fail" | "skip";
  * sealed: a new failure mode means a new member here PLUS the `code` set at the
  * emitter; never derive a code by matching `detail`.
  */
-type CheckCode = "env.node-runtime" | "env.git-missing" | "env.dev-tool-missing" | "env.tool-install-blocked" | "cert.ca-missing" | "tls.verify-failed" | "npm.runtime-broken" | "path.missing" | "mcp.blocked" | "mcp.uv-missing" | "mcp.config-missing" | "mcp.unvendored-offline" | "mcp.policy-denied" | "mcp.hardcoded-secret" | "mcp.allowlist-drift" | "cli.not-detected" | "cli.config-only" | "cli.bootloader-missing" | "cli.bootloader-drift" | "cli.wont-load" | "canon.router-missing" | "canon.context-dir-missing" | "canon.lint-failed" | "canon.adoptable" | "canon.cli-native-unmigrated" | "secrets.plaintext-detected" | "guardrails.gitleaks-missing" | "usage.no-data" | "scale.code-review-graph-missing" | "contract.path-unportable" | "contract.stale" | "org-policy.drift" | "report.context-over-budget" | "report.low-adoption" | "report.contract-untrue" | "ready.blocked" | "trust.fetch-blocked" | "trust.detector-unavailable" | "trust.hidden-unicode" | "trust.prompt-injection" | "trust.source-changed" | "trust.auto-exec-hook" | "trust.dependency-confusion" | "trust.typosquat" | "trust.malicious-code" | "trust.source-drift" | "trust.unpinned-dependency" | "trust.untrusted-publisher" | "trust.unsigned-source" | "trust.license-missing" | "trust.unapproved-skill";
+type CheckCode = "env.node-runtime" | "env.git-missing" | "env.dev-tool-missing" | "env.tool-install-blocked" | "cert.ca-missing" | "tls.verify-failed" | "npm.runtime-broken" | "path.missing" | "mcp.blocked" | "mcp.uv-missing" | "mcp.config-missing" | "mcp.unvendored-offline" | "mcp.policy-denied" | "mcp.hardcoded-secret" | "mcp.allowlist-drift" | "cli.not-detected" | "cli.config-only" | "cli.bootloader-missing" | "cli.bootloader-drift" | "cli.wont-load" | "canon.router-missing" | "canon.context-dir-missing" | "canon.lint-failed" | "canon.adoptable" | "canon.cli-native-unmigrated" | "secrets.plaintext-detected" | "guardrails.gitleaks-missing" | "usage.no-data" | "scale.code-review-graph-missing" | "contract.path-unportable" | "contract.stale" | "org-policy.drift" | "org-policy.invalid" | "org-policy.bundle-invalid" | "report.context-over-budget" | "report.low-adoption" | "report.contract-untrue" | "ready.blocked" | "trust.fetch-blocked" | "trust.detector-unavailable" | "trust.hidden-unicode" | "trust.prompt-injection" | "trust.source-changed" | "trust.auto-exec-hook" | "trust.dependency-confusion" | "trust.typosquat" | "trust.malicious-code" | "trust.source-drift" | "trust.unpinned-dependency" | "trust.untrusted-publisher" | "trust.unsigned-source" | "trust.license-missing" | "trust.unapproved-skill" | "pack.duplicate-name" | "pack.pin-mismatch" | "pack.missing-approval" | "pack.unknown-manifest" | "marketplace.manifest-parse" | "marketplace.path-traversal" | "marketplace.missing-file" | "marketplace.checksum-mismatch" | "marketplace.sums-coverage" | "marketplace.unapproved-verdict" | "marketplace.signature";
 interface Check {
     name: string;
     verdict: Verdict;
@@ -311,6 +311,16 @@ interface ExecAction {
     blockProbesOnFailure?: boolean;
     /** Continue the plan even if the command exits non-zero. */
     allowFailure?: boolean;
+    /**
+     * Apply-time content pin: refuse to run (abort the apply) unless the file's
+     * bytes still hash to `sha256` — pins an apply-time exec to the plan-time
+     * preflighted content, so nothing swapped in between plan and apply can ever
+     * be consumed by the command (the validate-then-use TOCTOU).
+     */
+    expect?: {
+        path: string;
+        sha256: string;
+    };
 }
 /**
  * Upsert an aih-managed env block (one `scope`) into a shell profile. Unlike a
@@ -480,6 +490,7 @@ declare function exec(describe: string, argv: string[], opts?: {
     timeoutMs?: number;
     failureCheck?: ExecAction["failureCheck"];
     blockProbesOnFailure?: boolean;
+    expect?: ExecAction["expect"];
 }): ExecAction;
 declare function envBlock(path: string, scope: string, shell: EnvShell, vars: EnvVar[], describe: string): EnvBlockAction;
 declare function remove(path: string, describe: string, opts?: {
@@ -493,7 +504,29 @@ declare const CAPABILITIES: CommandSpec[];
 /** Read-only commands (always safe). */
 declare const READONLY: CommandSpec[];
 declare const ALL_COMMANDS: CommandSpec[];
-declare function registerCommands(program: Command): void;
+/**
+ * Every top-level name the core CLI claims: ALL_COMMANDS plus the parent group
+ * names (`workspace` is both a CommandSpec and a group — the Set folds it)
+ * plus commander's own reserved `help`/`version`. The plugin registry refuses
+ * any external spec colliding with one of these, so a plugin can never shadow
+ * `doctor`, capture the `marketplace` group, or impersonate `help`.
+ */
+declare function builtinCommandNames(): ReadonlySet<string>;
+/**
+ * Register every command on the program. `extra` carries EXTERNAL plugin specs
+ * (see src/plugins/registry.ts, already gated + collision-free): they flow
+ * through the IDENTICAL registerSpec path as the built-ins — same shared
+ * flags, same optional `[root]` positional, same runCapability action (posture
+ * resolution, dirty-worktree gate, run ledger). TOP-LEVEL specs only: a plugin
+ * cannot contribute subcommands to a parent group (trust/skill/pack/…) in v1.
+ *
+ * Containment: built-ins register OUTSIDE any try/catch — a throw there is a
+ * core bug that must crash loudly. Each plugin spec registers inside its own
+ * try/catch: a Commander throw (e.g. a flag conflict the structural gate
+ * cannot predict) drops THAT spec with a warning pushed to the `warnings`
+ * sink, and every other command stays live.
+ */
+declare function registerCommands(program: Command, extra?: CommandSpec[], warnings?: string[]): void;
 
 /** Resolved runtime settings (env defaults overlaid with CLI flags). */
 interface Settings {
@@ -699,6 +732,20 @@ declare class FsTransaction {
 }
 /** Read a file's text, or `undefined` if it does not exist. */
 declare function readIfExists(path: string): string | undefined;
+/**
+ * Open-then-read on ONE file descriptor: the regular-file check (`fstat` on the
+ * open fd, never a second path lookup) and the read cannot be raced apart, and
+ * a symlink swapped in after directory enumeration is refused at open where
+ * `O_NOFOLLOW` exists rather than silently followed. Returns undefined for
+ * anything that is not a readable regular file.
+ *
+ * Use this — not {@link readIfExists} — for any path DISCOVERED by a directory
+ * scan: a plain exists-then-read pair on a scanned path is a swap window where
+ * a symlink planted between enumeration and read gets silently followed and its
+ * target's bytes laundered into an artifact (marketplace build, evidence
+ * bundle, fleet bundle all package what they read).
+ */
+declare function readRegularFile(abs: string): Buffer | undefined;
 
 /**
  * Parse JSON or JSONC text (tolerant of comments + trailing commas). Returns
@@ -778,8 +825,141 @@ declare function parseCertLines(stdout: string): CertEntry[];
  */
 declare function parsePemBlocks(stdout: string, subject?: string): CertEntry[];
 
-declare const VERSION = "0.4.1";
-/** Build the configured commander program. Imported by both the CLI entry and tests. */
-declare function buildProgram(): Command;
+/**
+ * The pluggable command registry — aih's ONE extension seam (OPA/Semgrep-style
+ * open core). The public harness is complete and fully local on its own; on
+ * startup the CLI probes for a single optional peer package,
+ * {@link PLUGIN_PACKAGE}, and when it is installed and valid, the `aihCommands`
+ * CommandSpecs it exports merge into the registry and appear as NATIVE
+ * subcommands — flowing through the identical registration path as the
+ * built-ins (shared flags, posture resolution, dirty-worktree gate, run
+ * ledger), so the private package bolts on without forking the core. An
+ * unenrolled machine sees zero output and zero behavior change.
+ *
+ * Rules the seam is built on:
+ *  - LITERAL package name only. The probe always imports {@link PLUGIN_PACKAGE}
+ *    verbatim — never an env var, flag, or config value — so nothing
+ *    user-controlled can point the import at other code. (The `importer` and
+ *    `resolver` options are purely test seams; production uses the platform
+ *    dynamic import and `import.meta.resolve`.)
+ *  - SAME INSTALL TREE only. Before importing, the probe resolves where the
+ *    import WOULD load from and refuses anything outside the harness's own
+ *    install tree, so a global or `npx`-run aih pointed at a hostile repo can
+ *    never import that repo's planted `node_modules/@aihq/enterprise`. Honesty
+ *    note (also in the README): when aih itself is installed INSIDE the target
+ *    repo, the repo already controls the binary — the check draws the boundary
+ *    at "the tree aih runs from", nothing stronger.
+ *  - STARTUP BUDGET. The import races a timeout (default
+ *    {@link DEFAULT_IMPORT_TIMEOUT_MS} ms); a slow or wedged plugin degrades to
+ *    local-only with a warning instead of stalling every invocation. (`aih
+ *    --version` skips the probe entirely — see src/cli.ts.)
+ *  - Kill switch: `AIH_NO_PLUGINS=1` (read from the injectable `env`) skips the
+ *    probe without touching the importer at all.
+ *  - Fail open to LOCAL. A missing package is the normal unenrolled case
+ *    (silent — zero noise); anything else (the package present but failing to
+ *    resolve or load, a malformed export, an invalid or colliding spec)
+ *    degrades to local-only behavior with a one-line warning. A broken plugin
+ *    must never break the CLI.
+ *  - Built-ins always win: a plugin spec whose name collides with a built-in
+ *    command, a parent group, or commander's own `help`/`version` is refused
+ *    ("refusing to shadow").
+ *  - Shared + reserved flags are off-limits: a plugin option may not claim any
+ *    token from {@link SHARED_FLAG_TOKENS} (the addSharedFlags surface) or
+ *    commander's reserved `--help`/`-h`/`--version`/`-V`.
+ *  - `skipWorktreeGate` is never honored for plugin commands — the field is
+ *    stripped from the registered copy (see {@link stripWorktreeGateField}).
+ *  - Warnings render hostile input: every plugin-influenced string that lands
+ *    in a warning routes through {@link sanitizeLabel} first.
+ *
+ * Trust boundary note: the boundary is package INSTALLATION — by the time this
+ * module inspects the export, `import()` has already run the plugin's module
+ * code, exactly like any other installed dependency. The structural gate below
+ * is about REGISTRY INTEGRITY (only well-formed, non-colliding specs register),
+ * not sandboxing: a gated spec may use any {@link CommandSpec} field, including
+ * `readOnly` (`skipWorktreeGate` being the one carve-out).
+ */
+/** The one probed plugin package. Literal by design — see the module jsdoc. */
+declare const PLUGIN_PACKAGE = "@aihq/enterprise";
+interface PluginLoadResult {
+    commands: CommandSpec[];
+    warnings: string[];
+}
+/** Import seam so tests can simulate any module shape without installing anything. */
+type PluginImporter = (specifier: string) => Promise<unknown>;
+/**
+ * Resolver seam for the install-tree boundary: maps the package specifier to
+ * the FILE PATH the import would load from. Production uses
+ * `import.meta.resolve`; tests inject paths inside/outside the allowed roots.
+ */
+type PluginResolver = (specifier: string) => string;
+interface PluginLoadOptions {
+    /** Test seam replacing the platform dynamic import. */
+    importer?: PluginImporter;
+    /** Test seam replacing `import.meta.resolve` for the install-tree check. */
+    resolver?: PluginResolver;
+    /** Environment for the kill switch — matches runCapability's deps.env convention. */
+    env?: NodeJS.ProcessEnv;
+    /** Import budget in milliseconds (default {@link DEFAULT_IMPORT_TIMEOUT_MS}). */
+    timeoutMs?: number;
+}
+/**
+ * Long flag tokens `addSharedFlags` (src/commands/index.ts) puts on every
+ * capability subcommand. Mirrored as a constant because the registry must stay
+ * a leaf module — importing the command tree from here would create an import
+ * cycle (commands/index.ts imports {@link sanitizeLabel} back from this file).
+ * The mirror is pinned against the real addSharedFlags registration by
+ * tests/plugins/registry.test.ts, so any drift fails CI.
+ */
+declare const SHARED_FLAG_TOKENS: ReadonlySet<string>;
+/**
+ * Make a plugin-influenced string safe to echo in a one-line warning: collapse
+ * newlines to spaces, strip C0/C1 control characters (including ESC, so
+ * ANSI/OSC sequences lose their teeth) plus DEL, and truncate to `max` with an
+ * ellipsis. Exported so the plugin-registration containment in
+ * src/commands/index.ts routes through the SAME sanitizer — one
+ * implementation, no drift.
+ */
+declare function sanitizeLabel(value: string, max?: number): string;
+/**
+ * Every root the plugin is allowed to resolve under: each `node_modules`
+ * directory on the ancestor chain of THIS module's own file (after bundling,
+ * that file IS the CLI binary in `dist/`), plus `<package root>/node_modules`
+ * where the package root is the first ancestor directory carrying a
+ * package.json — that second clause covers running from the dev tree, where no
+ * ancestor is itself a node_modules. Everything is realpath'd; candidates that
+ * do not exist are dropped (a missing directory cannot contain the plugin).
+ * Exported as a test seam so tests can build paths inside a real root.
+ */
+declare function allowedPluginRoots(): string[];
+/**
+ * Probe for {@link PLUGIN_PACKAGE} and return its registrable CommandSpecs.
+ * Never throws: every failure mode degrades to `{ commands: [] }` plus at most
+ * one-line warnings, so the CLI stays fully local no matter how broken the
+ * plugin is. `AIH_NO_PLUGINS=1` (from `opts.env ?? process.env`) skips the
+ * probe entirely. See {@link PluginLoadOptions} for the test seams.
+ */
+declare function loadExternalCommands(builtinNames: ReadonlySet<string>, opts?: PluginLoadOptions): Promise<PluginLoadResult>;
+
+declare const VERSION = "0.6.0";
+/**
+ * Build the configured commander program. Imported by both the CLI entry and
+ * tests. Stays SYNC: `extra` lets callers merge pre-loaded plugin specs — the
+ * async plugin probe lives in {@link buildProgramWithPlugins}. `warnings` is an
+ * optional sink for per-spec registration containment: a plugin spec Commander
+ * refuses at registration time is dropped with a warning instead of taking the
+ * CLI down (see registerCommands in src/commands/index.ts).
+ */
+declare function buildProgram(extra?: CommandSpec[], warnings?: string[]): Command;
+/**
+ * The CLI entry's builder: probe for the optional `@aihq/enterprise` peer
+ * (fail-open to local — see src/plugins/registry.ts) and build with whatever
+ * validly loaded. `warnings` (probe + registration containment, in that order)
+ * is printed to stderr by the entry BEFORE parse; an unenrolled machine gets
+ * zero warnings and the exact buildProgram surface.
+ */
+declare function buildProgramWithPlugins(): Promise<{
+    program: Command;
+    warnings: string[];
+}>;
 
-export { ALL_COMMANDS, type AccelBackend, type Action, type ActionKind, type AdapterFactory, AihError, CAPABILITIES, type CertEntry, type Check, type CheckCode, type CommandOption, type CommandSpec, ContextDir, type DigestAction, DirtyWorktreeError, type DocAction, type EnvBlockAction, type EnvShell, type EnvVar, type ExecAction, FsTransaction, FsTxnError, type FsTxnResult, type GpuInfo, type GpuVendor, type HostAdapter, type HostAdapterOptions, MergeError, NotImplementedError, PathContainmentError, type Plan, type PlanContext, type PlanFn, type PlanResult, type Platform, PlatformError, type ProbeAction, READONLY, type RemoveAction, type RemoveSummary, type RunOptions, type RunResult, type Runner, type Settings, SettingsError, VERSION, type VdiInfo, type Verdict, VerificationError, VerificationReport, type WriteAction, type WriteSummary, beginMarker, buildProgram, deepMerge, defaultRunner, derBase64ToPem, digest, doc, dynamicDigest, endMarker, ensureTrailingNewline, envBlock, exec, executePlan, fakeRunner, formatExport, frontmatter, indent, isPlainObject, jsonFile, lines, loadSettings, makeHostAdapter, managedBlock, missingToolRunner, parseCertLines, parseFirstInt, parseJsoncText, parseNvidiaSmi, parsePemBlocks, plan, probe, probeMany, readIfExists, registerCommands, remove, removeManagedBlock, resolveContents, resolvePlatform, retryTransient, safeCaPattern, stripTrailingNewlines, summarizeResult, upsertManagedBlock, upsertTextBlock, vdiFromEnv, writeArtifact, writeJson, writeText };
+export { ALL_COMMANDS, type AccelBackend, type Action, type ActionKind, type AdapterFactory, AihError, CAPABILITIES, type CertEntry, type Check, type CheckCode, type CommandOption, type CommandSpec, ContextDir, type DigestAction, DirtyWorktreeError, type DocAction, type EnvBlockAction, type EnvShell, type EnvVar, type ExecAction, FsTransaction, FsTxnError, type FsTxnResult, type GpuInfo, type GpuVendor, type HostAdapter, type HostAdapterOptions, MergeError, NotImplementedError, PLUGIN_PACKAGE, PathContainmentError, type Plan, type PlanContext, type PlanFn, type PlanResult, type Platform, PlatformError, type PluginImporter, type PluginLoadOptions, type PluginLoadResult, type PluginResolver, type ProbeAction, READONLY, type RemoveAction, type RemoveSummary, type RunOptions, type RunResult, type Runner, SHARED_FLAG_TOKENS, type Settings, SettingsError, VERSION, type VdiInfo, type Verdict, VerificationError, VerificationReport, type WriteAction, type WriteSummary, allowedPluginRoots, beginMarker, buildProgram, buildProgramWithPlugins, builtinCommandNames, deepMerge, defaultRunner, derBase64ToPem, digest, doc, dynamicDigest, endMarker, ensureTrailingNewline, envBlock, exec, executePlan, fakeRunner, formatExport, frontmatter, indent, isPlainObject, jsonFile, lines, loadExternalCommands, loadSettings, makeHostAdapter, managedBlock, missingToolRunner, parseCertLines, parseFirstInt, parseJsoncText, parseNvidiaSmi, parsePemBlocks, plan, probe, probeMany, readIfExists, readRegularFile, registerCommands, remove, removeManagedBlock, resolveContents, resolvePlatform, retryTransient, safeCaPattern, sanitizeLabel, stripTrailingNewlines, summarizeResult, upsertManagedBlock, upsertTextBlock, vdiFromEnv, writeArtifact, writeJson, writeText };

package/dist/index.js

@@ -1 +1 @@
-import{$ as fr,A as Y,B as _,C as c,D as h,E as j,F as k,G as q,H as v,I as w,J as y,K as z,L as F,M as G,N as H,O as J,P as K,Q,R as U,S as W,T as X,U as Z,V as $,W as rr,X as or,Y as mr,Z as er,_ as tr,a as p,aa as pr,b as x,ba as xr,c as A,ca as Ar,d as I,da as Ir,e as L,ea as r,f as C,fa as o,g as E,ga as m,h as N,ha as e,i as O,ia as t,j as S,ja as f,k as a,l as d,m as g,n as i,o as s,p as D,q as M,r as P,s as R,t as b,u as l,v as n,w as u,x as B,y as T,z as V}from"./chunk-Z2VMMIMJ.js";export{m as ALL_COMMANDS,p as AihError,r as CAPABILITIES,g as ContextDir,O as DirtyWorktreeError,a as FsTransaction,I as FsTxnError,E as MergeError,C as NotImplementedError,N as PathContainmentError,A as PlatformError,o as READONLY,x as SettingsError,t as VERSION,L as VerificationError,K as VerificationReport,k as beginMarker,f as buildProgram,J as deepMerge,Z as defaultRunner,or as derBase64ToPem,P as digest,M as doc,R as dynamicDigest,q as endMarker,j as ensureTrailingNewline,u as envBlock,n as exec,W as executePlan,$ as fakeRunner,w as formatExport,c as frontmatter,_ as indent,H as isPlainObject,h as jsonFile,Y as lines,i as loadSettings,Ir as makeHostAdapter,v as managedBlock,rr as missingToolRunner,pr as parseCertLines,tr as parseFirstInt,G as parseJsoncText,fr as parseNvidiaSmi,xr as parsePemBlocks,T as plan,b as probe,l as probeMany,d as readIfExists,e as registerCommands,B as remove,F as removeManagedBlock,U as resolveContents,Ar as resolvePlatform,S as retryTransient,mr as safeCaPattern,V as stripTrailingNewlines,X as summarizeResult,y as upsertManagedBlock,z as upsertTextBlock,er as vdiFromEnv,Q as writeArtifact,D as writeJson,s as writeText};
+import{$ as xr,A as Y,B as _,C as c,D as j,E as k,F as q,G as v,H as w,I as y,J as z,K as F,L as G,M as H,N as J,O as K,P as Q,Q as U,R as X,S as Z,T as $,U as rr,V as or,W as mr,X as er,Y as tr,Z as fr,_ as pr,a as i,aa as ir,b as a,ba as ar,c as A,ca as Ar,d,da as dr,e as g,ea as gr,f as l,fa as lr,g as n,ga as nr,h as s,ha as sr,i as u,ia as ur,j as C,ja as Cr,k as I,ka as r,l as L,la as o,m as N,ma as m,n as P,na as e,o as b,oa as t,p as E,pa as f,q as O,qa as p,r as S,s as D,sa as x,t as M,u as R,v as h,w as B,x as T,y as V,z as W}from"./chunk-PHJ6DL2Y.js";export{m as ALL_COMMANDS,i as AihError,r as CAPABILITIES,P as ContextDir,u as DirtyWorktreeError,I as FsTransaction,d as FsTxnError,n as MergeError,l as NotImplementedError,lr as PLUGIN_PACKAGE,s as PathContainmentError,A as PlatformError,o as READONLY,nr as SHARED_FLAG_TOKENS,a as SettingsError,f as VERSION,g as VerificationError,U as VerificationReport,ur as allowedPluginRoots,v as beginMarker,p as buildProgram,x as buildProgramWithPlugins,e as builtinCommandNames,Q as deepMerge,or as defaultRunner,tr as derBase64ToPem,D as digest,S as doc,M as dynamicDigest,w as endMarker,q as ensureTrailingNewline,T as envBlock,B as exec,$ as executePlan,mr as fakeRunner,z as formatExport,j as frontmatter,c as indent,K as isPlainObject,k as jsonFile,_ as lines,Cr as loadExternalCommands,b as loadSettings,gr as makeHostAdapter,y as managedBlock,er as missingToolRunner,ar as parseCertLines,xr as parseFirstInt,J as parseJsoncText,ir as parseNvidiaSmi,Ar as parsePemBlocks,W as plan,R as probe,h as probeMany,L as readIfExists,N as readRegularFile,t as registerCommands,V as remove,H as removeManagedBlock,Z as resolveContents,dr as resolvePlatform,C as retryTransient,fr as safeCaPattern,sr as sanitizeLabel,Y as stripTrailingNewlines,rr as summarizeResult,F as upsertManagedBlock,G as upsertTextBlock,pr as vdiFromEnv,X as writeArtifact,O as writeJson,E as writeText};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aihq/harness",
-  "version": "0.4.1",
+  "version": "0.6.0",
   "description": "Enterprise AI Bootstrapping Harness — bootstraps governed, proxy-safe AI coding into workstations and repos",
   "repository": {
     "type": "git",