@dzhechkov/harness-cli 0.3.240 → 0.3.241

package/.dz-manifest.json

@@ -9,7 +9,7 @@
       },
       {
         "path": "README.md",
-        "sha256": "1356d1ebf22352d0ab57ebe17fb91bb8c4df17da8b6968863a92b92402921bb7"
+        "sha256": "5b07e06ab04301ad1edfa9207b705266b57f3288f474f19ef7f22747237b6e67"
       },
       {
         "path": "coverage/coverage-final.json",
@@ -73,7 +73,7 @@
       },
       {
         "path": "package.json",
-        "sha256": "b729864fd3fb9fc4cf2fcab96c6aa36f13ed181f3aa2bb37c6b3ca0c893afd76"
+        "sha256": "dc78329bbed8510db61dc597124a455a1ce367f4ce1f0258a171ee6207ebb1e6"
       },
       {
         "path": "src/bin.ts",
@@ -101,5 +101,5 @@
       }
     ]
   },
-  "signature": "qMYFndIEe8HqlomfBmJrqsujcr/krjDvnlUuzoSIuw5v6muHu/4VQxha9DnqUpyfyz1MNAHgfo6N841osW0UCg=="
+  "signature": "cgLA1on1Innvb62VlQWouPeWuDW5Lo1E0W8Yq6p0N1rZ36HGvOxoLsYAYfFjYSikQ2QhM3NxE1CESshVuPh6Bw=="
 }

package/README.md

@@ -471,10 +471,20 @@ dz skills-verify: FAIL — nothing can register: 24 layout problem(s) and no reg
     [buried-skill-md] health-advisor/skills/clinical-decision-support/SKILL.md is 2+ levels deep …
 ```
 
-A `.claude-plugin/plugin.json` under `.claude/skills/` is reported as an **advisory**, not a failure:
-that layout may load under workspace trust, so the verdict asks the session whether the plugin actually
-loaded (`init.plugins`) instead of judging the layout. A container with skills inside and no matching
-loaded plugin fails, and says exactly that.
+**What it promises about plugins — and what it deliberately does not.** A `.claude-plugin/plugin.json`
+under `.claude/skills/` makes that directory a plugin *container*. The gate attributes it by the
+session's `init.plugins[].path` (never by the directory name), and:
+
+- container declares a plugin that **did not load** → **FAIL**, naming it;
+- container's plugin **loaded** → **PASS**, plus an advisory stating that its *individual* skills were
+  **not** verified.
+
+That last line is a deliberate limit, not an oversight. Verifying each plugin skill means reproducing
+Claude Code's command-name resolution — a skill's frontmatter `name` replaces the final command segment,
+and a manifest's `skills` field may be a string, a list, or a directory of children. Six cross-model
+review rounds showed every attempt to model that contract introduced a NEW wrong verdict. A narrow
+promise kept exactly is worth more than a broad one kept unreliably, so the gap is printed rather than
+guessed.
 
 **Exit codes: `0` pass · `1` fail · `2` inconclusive.** The third is the point — a missing `claude`
 binary, a login prompt, a timeout, or a session that read a *different* project all yield

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dzhechkov/harness-cli",
-  "version": "0.3.240",
+  "version": "0.3.241",
   "description": "The dz CLI — install AI skills for Claude Code, Codex, OpenCode, Hermes, OpenClaude, GitHub Copilot. 35 commands, 13 presets, 6 platform targets.",
   "type": "module",
   "license": "MIT",
@@ -57,7 +57,7 @@
     "@dzhechkov/skills-reverse-engineering": "^0.1.0",
     "@dzhechkov/skills-presentation-storyteller": "^0.1.0",
     "@dzhechkov/skills-website-cloner": "^0.1.0",
-    "@dzhechkov/harness-core": "0.3.131"
+    "@dzhechkov/harness-core": "0.3.132"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",

package/sbom.json

@@ -25,7 +25,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "1356d1ebf22352d0ab57ebe17fb91bb8c4df17da8b6968863a92b92402921bb7"
+          "content": "5b07e06ab04301ad1edfa9207b705266b57f3288f474f19ef7f22747237b6e67"
         }
       ]
     },
@@ -185,7 +185,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "b729864fd3fb9fc4cf2fcab96c6aa36f13ed181f3aa2bb37c6b3ca0c893afd76"
+          "content": "dc78329bbed8510db61dc597124a455a1ce367f4ce1f0258a171ee6207ebb1e6"
         }
       ]
     },