@dungle-scrubs/harness-cli-normalizer 0.6.0 → 0.6.2

package/src/knowledge/codex.ts

@@ -23,7 +23,6 @@ export const codexCli: HarnessDescriptor = deepFreeze({
     baseFlags: ["exec", "--json", "--skip-git-repo-check"],
     subcommands: ["exec"],
     promptStyle: "positional",
-    toolsFlag: null,
     streamFlags: [],
     // Codex mints its own thread id; there is nothing to assign at launch.
     idFlag: null,
@@ -62,11 +61,13 @@ export const codexCli: HarnessDescriptor = deepFreeze({
   autonomy: { flag: "--yolo" },
   vocabulary: {
     modelFlag: "--model",
-    models: ["gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna", "gpt-5.5"],
+    models: ["gpt-6-astra", "gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna", "gpt-5.5"],
     aliases: {},
     efforts: ["minimal", "low", "medium", "high", "xhigh", "max"],
     // Codex constrains ladders per model generation (v1 registry).
     effortsByModel: {
+      // https://developers.openai.com/api/docs/models/gpt-6-astra (2026-09-06).
+      "gpt-6-astra": ["low", "medium", "high", "xhigh", "max"],
       "gpt-5.5": ["minimal", "low", "medium", "high"],
       "gpt-5.6-sol": ["medium", "high", "xhigh", "max"],
       "gpt-5.6-terra": ["medium", "high", "xhigh", "max"],
@@ -109,6 +110,14 @@ export const codexCli: HarnessDescriptor = deepFreeze({
     observedOn: { harness: "codex", model: "", version: "0.146.1", date: "2026-08-19" },
   },
   turnOptions: {
+    // Codex config reference; accepted as an integer on CLI 0.153.4.
+    // Native compaction uses this window; hcn does not count request tokens.
+    contextWindow: {
+      kind: "integer",
+      min: 1,
+      max: 272000,
+      render: { kind: "config-kv", flag: "-c", key: "model_context_window" },
+    },
     effort: {
       kind: "effort",
       render: { kind: "config-kv", flag: "-c", key: "model_reasoning_effort" },
@@ -138,11 +147,27 @@ export const codexCli: HarnessDescriptor = deepFreeze({
       // caller asked.
       resumeRender: { kind: "config-kv", flag: "-c", key: "sandbox_mode" },
     },
+    // The preset maps onto the sandbox dimension and therefore CLAIMS it:
+    // an explicit --sandbox alongside --access refuses, and the profile's
+    // sandbox default yields. Data here, not a harness-name branch.
+    // On resume the preset rides the same config-kv spelling the sandbox
+    // dimension uses (issue #72 evidence above): `codex exec resume`
+    // rejects --sandbox, and -c sandbox_mode is enforced there.
     access: {
-      kind: "flag-value",
-      flag: "--sandbox",
-      values: { read: "read-only", write: "workspace-write" },
-      render: { kind: "flag-value", flag: "--sandbox" },
+      kind: "access",
+      claims: "sandbox",
+      renders: {
+        read: {
+          render: { kind: "flag-value", flag: "--sandbox" },
+          resumeRender: { kind: "config-kv", flag: "-c", key: "sandbox_mode" },
+          value: "read-only",
+        },
+        write: {
+          render: { kind: "flag-value", flag: "--sandbox" },
+          resumeRender: { kind: "config-kv", flag: "-c", key: "sandbox_mode" },
+          value: "workspace-write",
+        },
+      },
     },
   },
   // Tools: no built-in name lists; control is feature booleans
@@ -158,7 +183,6 @@ export const codexCli: HarnessDescriptor = deepFreeze({
     includeFlag: null,
     excludeFlag: null,
     includeIsStrictAllowlist: false,
-    composable: false,
     builtins: [],
     categories: [
       { key: "shell", disableFlag: null, configKey: "features.shell_tool", canonical: [] },

package/src/knowledge/descriptor.ts

@@ -41,9 +41,50 @@ export const CANONICAL_TOOLS = deepFreeze([
 ] as const);
 export type CanonicalTool = (typeof CANONICAL_TOOLS)[number];
 
-export type StreamingGranularity = "token" | "message" | "none";
+/** Every closed string vocabulary on a descriptor is declared once as a
+ * runtime array with its type derived (RFC-02 change 9), so a CLI list, an
+ * override validator, or a test reads the array instead of restating it. */
+export const STREAMING_GRANULARITIES = deepFreeze(["token", "message", "none"] as const);
+export type StreamingGranularity = (typeof STREAMING_GRANULARITIES)[number];
 
-export type HarnessMode = "headless-turn" | "headless-session" | "interactive";
+export const HARNESS_MODES = deepFreeze([
+  "headless-turn",
+  "headless-session",
+  "interactive",
+] as const);
+export type HarnessMode = (typeof HARNESS_MODES)[number];
+
+export const STDIN_POLICIES = deepFreeze(["inherit", "close-required"] as const);
+export type StdinPolicy = (typeof STDIN_POLICIES)[number];
+
+export const CWD_SLUGS = deepFreeze(["dash-separators", "pi-dash-wrapped", "verbatim"] as const);
+export type CwdSlug = (typeof CWD_SLUGS)[number];
+
+export const RESUME_STYLES = deepFreeze(["flag", "positional"] as const);
+export type ResumeStyle = (typeof RESUME_STYLES)[number];
+
+export const RESUME_ON_MISSING = deepFreeze(["error", "create"] as const);
+export type ResumeOnMissing = (typeof RESUME_ON_MISSING)[number];
+
+export const IDENTITY_AUTHORITIES = deepFreeze(["caller-assigned", "harness-minted"] as const);
+export type IdentityAuthority = (typeof IDENTITY_AUTHORITIES)[number];
+
+export const DENY_SEMANTICS = deepFreeze(["remove-from-set", "policy-gate", "no-lists"] as const);
+export type DenySemantics = (typeof DENY_SEMANTICS)[number];
+
+export const SKILLS_OVERRIDES_VIA = deepFreeze([
+  "settings-skilloverrides",
+  "config-skills-array",
+] as const);
+export type SkillsOverridesVia = (typeof SKILLS_OVERRIDES_VIA)[number];
+
+export const VERSION_SOURCE_KINDS = deepFreeze(["npm", "installed"] as const);
+export type VersionSourceKind = (typeof VERSION_SOURCE_KINDS)[number];
+
+/** The access preset's value vocabulary: `read` narrows to the read-only
+ * tool subset, `write` is no restriction. */
+export const ACCESS_VALUES = deepFreeze(["read", "write"] as const);
+export type AccessValue = (typeof ACCESS_VALUES)[number];
 
 export const SESSION_INPUT_KINDS = ["claude-sdk-user-message", "pi-rpc-prompt"] as const;
 export type SessionInputKind = (typeof SESSION_INPUT_KINDS)[number];
@@ -105,8 +146,10 @@ export type UnavailableMatcher = PhraseMatcher;
  * arm would be dead data that can only drift. Render order is the tuple
  * order, so argv is deterministic regardless of caller field order. */
 export const TURN_OPTION_KEYS = deepFreeze([
+  "isolation",
   "effort",
   "sandbox",
+  "contextWindow",
   "provider",
   "discovery",
   "write",
@@ -158,6 +201,12 @@ export interface SpecBase {
   readonly resumeRender?: OptionRender | null;
 }
 
+/** How one access value renders on one harness (RFC-02 change 3): the
+ * marker for "render the read preset through the tool list", null for
+ * "emit nothing", or a phase-aware render carrying the harness value it
+ * maps to (codex: `read` is `--sandbox read-only`). */
+export type AccessRender = "tool-preset" | null | (SpecBase & { readonly value?: string });
+
 export type TurnOptionSpec =
   /** Closed value vocabulary. `default` renders on LAUNCH ONLY. */
   | (SpecBase & {
@@ -165,17 +214,15 @@ export type TurnOptionSpec =
       readonly values: readonly string[];
       readonly default?: string;
     })
-  /** Access preset: read/write dimension with per-harness rendering. */
-  | (SpecBase & { readonly kind: "tool-preset" })
-  | (SpecBase & {
-      readonly kind: "flag-value";
-      readonly flag: string;
-      readonly values: Readonly<Record<string, string>>;
-    })
-  | (SpecBase & {
-      readonly kind: "flag-list-by-value";
-      readonly flags: Readonly<Record<string, readonly string[]>>;
-    })
+  /** The access preset: one kind on every harness that expresses it, a
+   *  render per value, and `claims` naming the turn option the preset
+   *  displaces when set (codex: sandbox) so exclusivity is data, not a
+   *  harness name. */
+  | {
+      readonly kind: "access";
+      readonly renders: Readonly<Record<AccessValue, AccessRender>>;
+      readonly claims?: TurnOptionKey;
+    }
   /** Ladder comes from vocabulary.efforts / effortsByModel, not from here. */
   | (SpecBase & { readonly kind: "effort" })
   /** Open selector, CLEAN_SELECTOR-validated. */
@@ -208,28 +255,37 @@ export const resolveRender = (spec: SpecBase, phase: "launch" | "resume"): Optio
   return spec.resumeRender ?? spec.render;
 };
 
-/** Alias for `resolveRender` with the resume-only null semantics made
- * explicit in the name; useful for tests asserting the "omitted => same as
- * render, null => unexpressible" contract. */
-export const resolveResumeRender = (spec: SpecBase): OptionRender | null =>
-  resolveRender(spec, "resume");
-
-/** Like `resolveRender` but for a `TurnOptionSpec` that may be a `discovery`
- * table. Returns null for an unexpressible resume, the spec's render for
- * non-discovery specs, and for discovery returns the spec itself (facets are
- * resolved per-facet via `resolveRender`). */
-export const getOptionRender = (
-  spec: TurnOptionSpec,
-  phase: "launch" | "resume",
-): OptionRender | null => {
-  if (
-    spec.kind === "discovery" ||
-    spec.kind === "tool-preset" ||
-    spec.kind === "flag-value" ||
-    spec.kind === "flag-list-by-value"
-  )
-    return null;
-  return resolveRender(spec as SpecBase, phase);
+export type Quoting = "toml" | "verbatim";
+
+/** The argv tokens one resolved render produces for one value - the only
+ * place a render kind becomes tokens (RFC-02 change 1). `toml` quoting is
+ * `JSON.stringify`, sufficient for the closed vocabularies that ride
+ * config-kv; `verbatim` passes prose (prompt text) and bare TOML literals
+ * through unchanged. A flag-value or config-kv render with no value is a
+ * descriptor error, never an empty token. */
+export const tokensFor = (
+  render: OptionRender,
+  value?: string,
+  quoting: Quoting = "toml",
+): readonly string[] => {
+  switch (render.kind) {
+    case "flag-value":
+      if (value === undefined) {
+        throw new Error(`render ${render.flag} needs a value and none was given`);
+      }
+      return [...(render.extraFlags ?? []), render.flag, value];
+    case "config-kv":
+      if (value === undefined) {
+        throw new Error(`render ${render.flag} ${render.key} needs a value and none was given`);
+      }
+      return [render.flag, `${render.key}=${quoting === "toml" ? JSON.stringify(value) : value}`];
+    case "flag-list":
+      return [...render.flags];
+    default: {
+      const exhaustive: never = render;
+      return exhaustive;
+    }
+  }
 };
 
 export interface HarnessDescriptor {
@@ -251,8 +307,8 @@ export interface HarnessDescriptor {
    * have no registry to poll, so the check falls back to the locally
    * installed `<bin> --version` and is skipped where the CLI is absent. */
   readonly versionSource:
-    | { readonly kind: "npm"; readonly package: string }
-    | { readonly kind: "installed" };
+    | { readonly kind: Extract<VersionSourceKind, "npm">; readonly package: string }
+    | { readonly kind: Extract<VersionSourceKind, "installed"> };
   /** Headless one-turn launch shape. `promptStyle: "positional"` means the
    * prompt travels as a bare argv entry (ordering constraints apply).
    * `streamFlags` is the output flag set a headless turn launches with so
@@ -267,7 +323,6 @@ export interface HarnessDescriptor {
      * `workspace-write` into subcommands. */
     readonly subcommands: readonly string[];
     readonly promptStyle: "positional";
-    readonly toolsFlag: string | null;
     readonly streamFlags: readonly string[];
     /** The flag that pins a caller-assigned id at LAUNCH (spawn-time
      * assignment; the execution layer consumes it), or null when the
@@ -281,7 +336,7 @@ export interface HarnessDescriptor {
    * anywhere else (the v1 first-UUID-wins scar: a UUID inside quoted prompt
    * text was returned as the session id, and resuming it started a stranger). */
   readonly resume: {
-    readonly style: "flag" | "positional";
+    readonly style: ResumeStyle;
     readonly flag: string;
     readonly aliases: readonly string[];
     readonly idShape: RegExp;
@@ -299,7 +354,7 @@ export interface HarnessDescriptor {
      * The protocol layer must know this: a consumer resuming a session it
      * believes exists gets a blank session, not an error, on a "create"
      * harness. */
-    readonly onMissing: "error" | "create";
+    readonly onMissing: ResumeOnMissing;
   };
   /** Persistent headless session support: the complete flag list that follows
    * the binary to open one lucid-owned process serving many turns, or null
@@ -327,7 +382,11 @@ export interface HarnessDescriptor {
     readonly resumeFlag: SessionResumeFlag;
     readonly input: SessionInputContract;
     readonly turnEnd: Readonly<Record<string, string>>;
-    readonly identityProbe: { readonly command: string } | null;
+    /** The command the runner writes at spawn to learn the session id, and
+     * the dot-path to that id in the response (pi rpc: `get_state`,
+     * `data.sessionId`). Encoded and decoded in interpretation
+     * (session-input.ts); execution holds no field names (ADR 0005). */
+    readonly identityProbe: { readonly command: string; readonly responseIdField: string } | null;
   } | null;
   /** Streaming is a property of the INVOCATION, not the harness: each pin
    * names the flag set that unlocks a granularity, checked in order, first
@@ -348,7 +407,7 @@ export interface HarnessDescriptor {
    * {type: "system", subtype: "init"}, re-emitted at every turn start with
    * the same value (A-001) - consumers dedupe via decodeIdentity. */
   readonly identity: {
-    readonly authority: "caller-assigned" | "harness-minted";
+    readonly authority: IdentityAuthority;
     /** `idField` is a dot-path (muse nests its id at `stream.id`); an empty
      * `match` means "any record carrying the id path". */
     readonly announce: {
@@ -387,7 +446,7 @@ export interface HarnessDescriptor {
     readonly template: string;
     /** claude: '/', '.' -> '-'; pi: '/' -> '-' wrapped in leading/trailing
      * dashes, dots preserved. */
-    readonly cwdSlug: "dash-separators" | "pi-dash-wrapped" | "verbatim";
+    readonly cwdSlug: CwdSlug;
   };
   /** How the harness exposes context-window usage; the interpretation layer
    * surfaces it as a `context` HarnessEvent. */
@@ -400,7 +459,7 @@ export interface HarnessDescriptor {
   readonly resumeLast: { readonly flag: string } | null;
   /** Whether backgrounded headless calls must have stdin closed (pi hangs
    * without `< /dev/null`). */
-  readonly stdin: "inherit" | "close-required";
+  readonly stdin: StdinPolicy;
   /** Presence recognition: how an interactive process for a session id shows
    * up in a process listing. `headlessMarkers` mark a process as headless
    * (not interactive presence). Known blind spot, inherent to argv matching:
@@ -445,8 +504,7 @@ export interface HarnessDescriptor {
    * the claude asymmetry: claude's include flag pre-approves without
    * restricting the visible set, so an exact allowlist must render as a
    * disallow-complement there; pi's include IS strict (over built-ins).
-   * `composable`: both flags legal at once (pi: exclude subtracts from
-   * include). `builtins`: curated names + default-enabled state - grep/find/
+   * `builtins`: curated names + default-enabled state - grep/find/
    * ls ship off on pi, everything ships on elsewhere. `categories`:
    * non-list switches (muse disable flags, codex config booleans).
    * `denySemantics`: whether a deny removes the tool from the model-visible
@@ -461,13 +519,12 @@ export interface HarnessDescriptor {
    * muse: null (structural gap - trust/config scoped only). */
   readonly skills: {
     readonly loadFlag: string | null;
-    readonly overridesVia: "settings-skilloverrides" | "config-skills-array" | null;
+    readonly overridesVia: SkillsOverridesVia | null;
   } | null;
   readonly tools: {
     readonly includeFlag: string | null;
     readonly excludeFlag: string | null;
     readonly includeIsStrictAllowlist: boolean;
-    readonly composable: boolean;
     readonly builtins: ReadonlyArray<{
       readonly name: string;
       readonly defaultEnabled: boolean;
@@ -479,6 +536,6 @@ export interface HarnessDescriptor {
       readonly configKey: string | null;
       readonly canonical: readonly CanonicalTool[];
     }>;
-    readonly denySemantics: "remove-from-set" | "policy-gate" | "no-lists";
+    readonly denySemantics: DenySemantics;
   };
 }

package/src/knowledge/matchers.ts

@@ -11,6 +11,41 @@ import type {
   UnavailableMatcher,
 } from "./descriptor.js";
 
+/** Bounds on a matcher, enforced wherever one is compiled - the limits
+ * scanner and the override loader alike (RFC-02 change 9). They keep a
+ * crafted override file from DoS'ing the compiler or the scanner; the
+ * input window, not pattern analysis, is the backtracking bound. */
+export const MAX_PATTERN_LENGTH = 200;
+export const MAX_MATCHERS_PER_KIND = 64;
+/** The only flags a matcher may carry. `g` and `y` are stateful and
+ * would make `test()` order-dependent. */
+export const MATCHER_FLAGS = "imsu";
+
+/** Compile one matcher under the bounds. Throws a plain Error naming the
+ * violated bound; loaders wrap it in their own refusal type. */
+export const compileMatcher = (pattern: string, flags: string | undefined): RegExp => {
+  const f = flags ?? "i";
+  if (pattern.length > MAX_PATTERN_LENGTH) {
+    throw new Error(`pattern over ${MAX_PATTERN_LENGTH} characters`);
+  }
+  if (pattern.length === 0) {
+    throw new Error("pattern must not be empty");
+  }
+  if (f.includes("g") || f.includes("y")) {
+    throw new Error(`flags must not contain g or y (got ${JSON.stringify(f)})`);
+  }
+  for (const ch of f) {
+    if (!MATCHER_FLAGS.includes(ch)) {
+      throw new Error(`flag ${JSON.stringify(ch)} outside ${MATCHER_FLAGS}`);
+    }
+  }
+  try {
+    return new RegExp(pattern, f);
+  } catch (e) {
+    throw new Error(`uncompilable pattern ${JSON.stringify(pattern)}: ${(e as Error).message}`);
+  }
+};
+
 export const SHARED_LIMIT_MATCHERS: ReadonlyArray<LimitMatcher> = [
   { pattern: "you'?ve hit your usage limit", flags: "i", code: "usage-limit" },
   { pattern: "usage limit (?:reached|exceeded)", flags: "i", code: "usage-limit" },

package/src/knowledge/muse.ts

@@ -24,7 +24,6 @@ export const museCode: HarnessDescriptor = deepFreeze({
     baseFlags: ["exec", "--json"],
     subcommands: ["exec"],
     promptStyle: "positional",
-    toolsFlag: null,
     streamFlags: [],
     idFlag: "--session-id",
   },
@@ -60,7 +59,12 @@ export const museCode: HarnessDescriptor = deepFreeze({
   autonomy: { flag: "--yolo" },
   vocabulary: {
     modelFlag: "--model",
-    models: ["muse-spark-1.2-contributor", "muse-spark-1.2", "muse-spark-1.1"],
+    models: [
+      "muse-spark-1.3-contributor",
+      "muse-spark-1.2-contributor",
+      "muse-spark-1.2",
+      "muse-spark-1.1",
+    ],
     aliases: {},
     efforts: ["none", "minimal", "low", "medium", "high", "xhigh"],
     extensible: false,
@@ -116,10 +120,14 @@ export const museCode: HarnessDescriptor = deepFreeze({
       max: 10000,
       render: { kind: "flag-value", flag: "--max-model-steps" },
     },
+    // read gates the write and shell categories; write is the harness
+    // default and emits nothing.
     access: {
-      kind: "flag-list-by-value",
-      flags: { read: ["--disable-write", "--disable-shell"], write: [] },
-      render: { kind: "flag-list", flags: ["--disable-write", "--disable-shell"] },
+      kind: "access",
+      renders: {
+        read: { render: { kind: "flag-list", flags: ["--disable-write", "--disable-shell"] } },
+        write: null,
+      },
     },
   },
   // Phase 0 fixtures: muse-category-flags.md. No name lists; category
@@ -133,7 +141,6 @@ export const museCode: HarnessDescriptor = deepFreeze({
     includeFlag: null,
     excludeFlag: null,
     includeIsStrictAllowlist: false,
-    composable: false,
     builtins: [],
     categories: [
       {

package/src/knowledge/overrides.ts

@@ -20,6 +20,7 @@ import {
   type HarnessName,
   SESSION_INPUT_KINDS,
 } from "./descriptor.js";
+import { compileMatcher, MAX_MATCHERS_PER_KIND } from "./matchers.js";
 import { museCode } from "./muse.js";
 import { piCli } from "./pi.js";
 
@@ -159,36 +160,12 @@ const validateMatcherPattern = (
   path: string,
   harness: string,
 ): void => {
-  const f = flags ?? "i";
-  if (pattern.length > 200) {
-    throw new OverrideRefusalError(
-      path,
-      `pattern over 200 characters: ${JSON.stringify(pattern.slice(0, 40))}`,
-      harness,
-    );
-  }
-  if (pattern.length === 0) {
-    throw new OverrideRefusalError(path, `pattern must not be empty`, harness);
-  }
-  if (f.includes("g") || f.includes("y")) {
-    throw new OverrideRefusalError(
-      path,
-      `flags must not contain g or y (got ${JSON.stringify(f)})`,
-      harness,
-    );
-  }
-  for (const ch of f) {
-    if (!"imsu".includes(ch))
-      throw new OverrideRefusalError(path, `flag ${JSON.stringify(ch)} outside imsu`, harness);
-  }
+  // One compiler and one set of bounds, shared with the limits scanner
+  // (RFC-02 change 9); this loader only wraps the refusal.
   try {
-    new RegExp(pattern, f);
+    compileMatcher(pattern, flags);
   } catch (e) {
-    throw new OverrideRefusalError(
-      path,
-      `uncompilable pattern ${JSON.stringify(pattern)}: ${(e as Error).message}`,
-      harness,
-    );
+    throw new OverrideRefusalError(path, (e as Error).message, harness);
   }
 };
 
@@ -196,8 +173,12 @@ const validateMatchers = (desc: HarnessDescriptor, path: string, harness: string
   const limitMatchers = (desc as unknown as { limitMatchers: readonly unknown[] }).limitMatchers;
   const authMatchers = (desc as unknown as { authMatchers: readonly unknown[] }).authMatchers;
   if (Array.isArray(limitMatchers)) {
-    if (limitMatchers.length > 64) {
-      throw new OverrideRefusalError(path, `more than 64 limit matchers`, harness);
+    if (limitMatchers.length > MAX_MATCHERS_PER_KIND) {
+      throw new OverrideRefusalError(
+        path,
+        `more than ${MAX_MATCHERS_PER_KIND} limit matchers`,
+        harness,
+      );
     }
     for (const m of limitMatchers) {
       if (!isPlain(m as unknown as Record<string, unknown>)) {
@@ -211,8 +192,12 @@ const validateMatchers = (desc: HarnessDescriptor, path: string, harness: string
     }
   }
   if (Array.isArray(authMatchers)) {
-    if (authMatchers.length > 64) {
-      throw new OverrideRefusalError(path, `more than 64 auth matchers`, harness);
+    if (authMatchers.length > MAX_MATCHERS_PER_KIND) {
+      throw new OverrideRefusalError(
+        path,
+        `more than ${MAX_MATCHERS_PER_KIND} auth matchers`,
+        harness,
+      );
     }
     for (const m of authMatchers) {
       if (!isPlain(m as unknown as Record<string, unknown>)) {

package/src/knowledge/pi.ts

@@ -22,7 +22,6 @@ export const piCli: HarnessDescriptor = deepFreeze({
     baseFlags: ["-p", "--mode", "json"],
     subcommands: [],
     promptStyle: "positional",
-    toolsFlag: null,
     streamFlags: [],
     idFlag: "--session-id",
   },
@@ -49,8 +48,10 @@ export const piCli: HarnessDescriptor = deepFreeze({
   // --mode rpc exists on 0.84.2 and its session semantics are now VERIFIED
   // against a live run (2026-08-19 spike, evidence at
   // test/fixtures/pi-rpc-spike): JSONL both directions, agent_settled
-  // delimits turns, steer/follow_up queue mid-run (hcn never needs them -
-  // it queues sends itself), identity is silent at startup and readable
+  // delimits turns, steer/follow_up queue mid-run (hcn keeps no queue of
+  // its own since ADR 0007 and writes a send when it arrives; a bare
+  // prompt mid-run is refused with success:false - spike fixture 05, a
+  // pending change), identity is silent at startup and readable
   // only via a get_state round trip, stdin EOF exits rc=0. The claude
   // slice remains the proven vertical (D-003); this entry is the second.
   sessionMode: {
@@ -73,7 +74,7 @@ export const piCli: HarnessDescriptor = deepFreeze({
     resumeFlag: "--session-id",
     input: { kind: "pi-rpc-prompt" },
     turnEnd: { type: "agent_settled" },
-    identityProbe: { command: "get_state" },
+    identityProbe: { command: "get_state", responseIdField: "data.sessionId" },
   },
   output: {
     // pi -p prints plain text; --mode json emits structured v3 records
@@ -173,7 +174,9 @@ export const piCli: HarnessDescriptor = deepFreeze({
         },
       },
     },
-    access: { kind: "tool-preset", render: { kind: "flag-value", flag: "--tools" } },
+    // read renders the read preset through --tools (strict allowlist);
+    // write is the harness default and emits nothing.
+    access: { kind: "access", renders: { read: "tool-preset", write: null } },
   },
   // Phase 0 fixtures: pi-both-tool-flags.md. Both list flags legal at once;
   // exclude subtracts from include. --tools is strict over BUILT-INS but
@@ -184,7 +187,6 @@ export const piCli: HarnessDescriptor = deepFreeze({
     includeFlag: "--tools",
     excludeFlag: "--exclude-tools",
     includeIsStrictAllowlist: true,
-    composable: true,
     builtins: [
       { name: "read", defaultEnabled: true, canonical: "read" },
       { name: "bash", defaultEnabled: true, canonical: "shell" },

package/src/knowledge/profile.ts

@@ -19,6 +19,7 @@ export const DEFAULT_TURN_PROFILE = deepFreeze({
   // profile tier. On the other three the dimension is unrenderable and
   // reports as divergence.
   sandbox: "workspace-write",
+  contextWindow: 272000,
   // Ratified: discovery fully ON. The harnesses' bare runs already
   // discover instruction files, skills, and extensions; the profile makes
   // that a stated contract. The off-spellings exist per harness

package/dist/interpretation/dimensions.d.ts

@@ -1,11 +0,0 @@
-/**
- * Small dimension accessors: one interpretation function per PLAN 3.1
- * dimension whose value is a direct descriptor lookup. They exist so every
- * dimension has a single named owner in the interpretation layer - callers
- * never reach into descriptor internals.
- */
-import type { HarnessDescriptor } from "../knowledge/descriptor.js";
-export declare const stdinPolicyOf: (h: HarnessDescriptor) => "inherit" | "close-required";
-export declare const toolsFlagOf: (h: HarnessDescriptor) => string | null;
-export declare const autonomyFlagOf: (h: HarnessDescriptor) => string | null;
-//# sourceMappingURL=dimensions.d.ts.map

package/dist/interpretation/dimensions.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"dimensions.d.ts","sourceRoot":"","sources":["../../src/interpretation/dimensions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAEpE,eAAO,MAAM,aAAa,MAAO,iBAAiB,KAAG,SAAS,GAAG,gBAA2B,CAAC;AAE7F,eAAO,MAAM,WAAW,MAAO,iBAAiB,KAAG,MAAM,GAAG,IAA0B,CAAC;AAEvF,eAAO,MAAM,cAAc,MAAO,iBAAiB,KAAG,MAAM,GAAG,IACjB,CAAC"}

package/dist/interpretation/dimensions.js

@@ -1,4 +0,0 @@
-export const stdinPolicyOf = (h) => h.stdin;
-export const toolsFlagOf = (h) => h.launch.toolsFlag;
-export const autonomyFlagOf = (h) => h.autonomy === null ? null : h.autonomy.flag;
-//# sourceMappingURL=dimensions.js.map

package/dist/interpretation/dimensions.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"dimensions.js","sourceRoot":"","sources":["../../src/interpretation/dimensions.ts"],"names":[],"mappings":"AAQA,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAoB,EAAgC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;AAE7F,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAoB,EAAiB,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;AAEvF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAoB,EAAiB,EAAE,CACpE,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC"}

package/src/interpretation/dimensions.ts

@@ -1,14 +0,0 @@
-/**
- * Small dimension accessors: one interpretation function per PLAN 3.1
- * dimension whose value is a direct descriptor lookup. They exist so every
- * dimension has a single named owner in the interpretation layer - callers
- * never reach into descriptor internals.
- */
-import type { HarnessDescriptor } from "../knowledge/descriptor.js";
-
-export const stdinPolicyOf = (h: HarnessDescriptor): "inherit" | "close-required" => h.stdin;
-
-export const toolsFlagOf = (h: HarnessDescriptor): string | null => h.launch.toolsFlag;
-
-export const autonomyFlagOf = (h: HarnessDescriptor): string | null =>
-  h.autonomy === null ? null : h.autonomy.flag;