@dzhechkov/harness-cli 0.5.4 → 0.6.0

package/dist/core-compat.d.ts

@@ -39,7 +39,7 @@
  * standing test (`test/core-import-floor.test.ts`, F1) fails if the two drift apart,
  * because a guard that says 0.4.7 while npm may install 0.4.2 is worse than no guard.
  */
-export declare const MIN_CORE = "0.5.4";
+export declare const MIN_CORE = "0.6.0";
 /** The npm name of the guarded package — one literal, used by every leg below. */
 export declare const CORE_PACKAGE_NAME = "@dzhechkov/harness-core";
 /**

package/dist/core-compat.js

@@ -42,7 +42,7 @@ import { fileURLToPath } from 'node:url';
  * standing test (`test/core-import-floor.test.ts`, F1) fails if the two drift apart,
  * because a guard that says 0.4.7 while npm may install 0.4.2 is worse than no guard.
  */
-export const MIN_CORE = '0.5.4';
+export const MIN_CORE = '0.6.0';
 /** The npm name of the guarded package — one literal, used by every leg below. */
 export const CORE_PACKAGE_NAME = '@dzhechkov/harness-core';
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dzhechkov/harness-cli",
-  "version": "0.5.4",
+  "version": "0.6.0",
   "description": "The dz CLI — install AI skills for Claude Code, Codex, OpenCode, Hermes, OpenClaude, GitHub Copilot. 67 commands, 14 presets, 10 platform targets.",
   "type": "module",
   "license": "MIT",
@@ -41,7 +41,7 @@
     "sbom.json"
   ],
   "dependencies": {
-    "@dzhechkov/harness-core": "^0.5.4",
+    "@dzhechkov/harness-core": "^0.6.0",
     "@dzhechkov/harness-presets": "^0.5.0",
     "@dzhechkov/scout": "^0.8.0",
     "@dzhechkov/skills-devops": "^0.3.0",

package/sbom.json

@@ -15,7 +15,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "9555ead768fef7963e735b0c6af21a64412811531534108be3df61bc65b51021"
+          "content": "fb63e4a05e205a1a2ec6806b61898a4aa5ea19148e4bb0e553e2c9b19e382a5f"
         }
       ]
     },
@@ -25,7 +25,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "0d475969dbc98308bf0e23a15700c537ed4947b3cf910b334e647e3972fc78fe"
+          "content": "e4d839c8ae59d86f2150bb632e0f8794688ccfa117974eb5f2605676912e7176"
         }
       ]
     },
@@ -105,7 +105,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "7c64ed0d976d79fd8f3970ced13e664db1e97c43f96a7b153d7b993948cc5f9f"
+          "content": "bc71c42fc8804e71454efde34beee1e4aed2d074ee029edf08fbee3e76cc369a"
         }
       ]
     },
@@ -115,7 +115,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "8052367d84a5a1c4a9f7fb3397a6297edf707031bbfa59b945d240d17e221f04"
+          "content": "b269e0a6c84ff4069655ee9cd8d264c3be16a12f7de2b849e8d9065d0b6c44b3"
         }
       ]
     },
@@ -125,7 +125,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "f759949bcfaa04c3f4eaebbccde688192d44f129b61115313533f8828f7376f8"
+          "content": "8ba4b1bc4d3cc767a686f54a63e38d247fe399ccdbc959951bc788cee52f1eef"
         }
       ]
     },
@@ -135,7 +135,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "f89dbd282c83fa64f23c8fff3c83bc85c08c8deef451fd4d525e33784c2a0e13"
+          "content": "a8a7f048200d1cde46e1c4b9a175734624f86b432e45db13ff69343ef41adee3"
         }
       ]
     },
@@ -155,7 +155,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "66fd34797f007aa0607698a159fb367a772f32f5be1c2a90748c20cbf4b973cf"
+          "content": "817a16aafa21f9d592e1b74fbc7b393208aa6cbe7a1ce44059b3d57e4897ca48"
         }
       ]
     },
@@ -225,7 +225,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "797bfd035a68dc039ca33393f02f4ed1fe97e1021559e01906a0fbbc9b28c1dc"
+          "content": "82ac146f7d849e1315dafc8ca4536e031d5c8104317da46ab8b52e543a187b17"
         }
       ]
     },
@@ -245,7 +245,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "9338e5f5dd5cbb1f3692cb7db53531f103bc28450c109765bf161664a7598a5b"
+          "content": "44be85b04467075bf671bc58572bf294f402b43abc76e23354724a74ea2a6c27"
         }
       ]
     },
@@ -255,7 +255,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "ba96d37f80c98618a1d8ca61cf071c9d26c74dab8d277106e9079068428a5b71"
+          "content": "80b02871db06aa78df70cdc166e46a67fa9335da2f4956d6f937149b7ea69698"
         }
       ]
     },
@@ -295,7 +295,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "f744cfe02805f567312a196805ebc49486c3e2a8e3f64de1700be276481f0cc1"
+          "content": "a637ef30d058fcd95dc18ef6eca45d6ac06e0f2bf54341a0aae68b610180b44d"
         }
       ]
     },
@@ -655,7 +655,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "be010af797aeae754a3dd3e9f6f25d6f01066d4bf2037a01322554453d943ee3"
+          "content": "fafa2d1ff56bd41a6496b7ce569be671f2f617deac07425f47ad6e87b3ec00ce"
         }
       ]
     },

package/src/cli.ts

@@ -399,6 +399,7 @@ import {
   serializeBundle,
   parseBundle,
   planImport,
+  decideCheckpointWrite,
 } from '@dzhechkov/harness-core';
 import type { MutationEntryResult, MutationObservation, MutationRegistryEntry } from '@dzhechkov/harness-core';
 import type { SkillApplyFailure, SkillLoadFailure } from '@dzhechkov/harness-core';
@@ -449,6 +450,7 @@ Usage:
   dz epoch-replay --judge <filled-work-order.json> [--out <file>]   (blind judge prompts from the filled plans)
   dz epoch-replay --score <judgments.json> --work-order <file> [--slice <name>] [--json]   (un-blind against the pre-registered assignment → SUPPORTED only when the two 95% Wilson CIs are DISJOINT, else FALSIFIED / INCONCLUSIVE)
   dz score --slug <feature> [--project <dir>] [--json]   (process scorecard for ONE feature-adr run, from its artifacts: ADR confirmation, discrimination, cross-model QE grade, live verification, README-first, learning loop, amendments — descriptive-only, a low score exits 0)
+  dz feature-adr-checkpoint (--slug <feature> | --feature-dir <abs>) --stage <s> --input-hash <h> --result <json> [--artifact a,b] [--json]   (record a pipeline stage ONLY after measuring its artifacts on disk; refuses a null result, an absent artifact, or a stage that declares none — the subagent runs a COMMAND instead of hand-writing durable state)
   dz reqe [--slug <feature> [--done --report <f>]] [--json]   (the re-QE debt ledger: a usage-switched run whose Step-8 QE ran on the coder's OWN family records a debt; list debts, print the cross-family review brief, settle FAIL-CLOSED against a graded report — the settlement lands in 08_qe_report.md)
   dz qe-bridge --family claude --slug <feature> [--coder-family codex|claude] [--model <id>] [--files a,b] [--out <f>] [--timeout <s>] [--allow-same-family] [--json]   (the REVERSE QE bridge: run an INDEPENDENT Claude reviewer over a feature's Step-8 artifacts from ANY host — a Codex session included, plain shell, no Claude agent plane needed — and land a PARSED signoff. The reviewer runs ISOLATED: an EMPTY temp cwd plus --safe-mode --strict-mcp-config --tools '' --no-session-persistence, so no CLAUDE.md/skills/plugins/hooks/MCP load, and the verdict is read from the --output-format json RESULT ENVELOPE — text a session customization printed onto the same stdout can never become a signoff. Probes the model before trusting it; sends SCOPED extracts with a loud 200k-char ceiling (never silent truncation); the grade must AGREE across three LAST-anchored channels (terminal marker line, fenced qe-bridge-signoff JSON, the report's own GRADE line) AND the marker must be the FINAL content — empty, gradeless, self-contradicting or miscounted output is one of 18 NAMED failures with an audit record under features/<slug>/.fa-state/qe-bridge/ (runId, resolved executable + binOverride, prompt sha256, channel offsets, requestedOut, reportWritten, retained raw stdout; 0600 files in a 0700 dir), never a clean review. A --coder-family that contradicts the recorded reqe debt is refused. Writes features/<slug>/08b_reqe_report.md, which dz reqe --done settles unchanged. DISCLOSURE: the extracts you scope are sent to the Claude runtime; the bridge cannot classify secrets. DZ_QE_BRIDGE_CLAUDE_BIN is a TEST SEAM, not a flag. exit 0 signoff parsed (ANY grade — it reports, it does not gate) / 1 named failure / 2 usage)
   dz mutation-gate [--package <dir>] [--registry <file>] [--test-cmd "<cmd>"] [--only <id[,id]>] [--timeout <ms>] [--rebaseline per-entry|final] [--keep-scratch] [--json]   (prove each NAMED protection has a test that DISCRIMINATES: copy the package to a scratch dir, verify the baseline suite is green, apply each registry mutation, run the suite, REQUIRE red, restore. The red must be BEHAVIOURAL: a mutation that no longer parses is MUTATION_UNPARSEABLE; a red run whose OWN output reports a test FILE failing to load (node --test file-level not-ok with exitCode, vitest Failed Suites) is MUTATION_LOAD_FATAL — the signal comes from the same run as the failing count, never from a separate isolated import; red output whose shape matches no known runner is INCONCLUSIVE (a runner-coverage gap, loud, never PROVEN); a count far above the entry's bound is OVER_FAILING; a restored tree that does not reproduce green makes the entry INCONCLUSIVE (flaky). Mutation writes are realpath-contained to the scratch copy: a symlink escape or a node_modules/ target is refused (exit 2), the real tree is never written. A mutation that does not apply, a green suite, or an inconclusive run is a FAILURE — never a skip. exit 0 all proven / 1 gate failed / 2 setup error)
@@ -8937,6 +8939,82 @@ function scanOneReqeRoot(
  * `dz reqe` — the re-QE debt ledger (backlog 6b40e667): list usage-switched same-family QE debts,
  * print the cross-family review brief, settle FAIL-CLOSED against a graded report.
  */
+/**
+ * `dz feature-adr checkpoint` — record a pipeline stage, but only after WITNESSING its artifacts.
+ *
+ * Why this is a command and not a line of shell (2026-08-21). The workflow script is sandboxed with
+ * no filesystem, so it delegated checkpoint writes to a subagent by handing it a finished JSON line
+ * and saying "append this". The subagent verified nothing. A safety classifier read that shape as one
+ * party instructing another to declare a verification gate complete, and blocked NINE consecutive
+ * writes in one run — router, four design substages, plan, code, qe, and the cost-ledger row. The
+ * measured consequence: `.fa-state/checkpoints.jsonl` was never created, resume was silently dead,
+ * and the six-hour run still reported success.
+ *
+ * The classifier's premise was wrong for those particular writes — every stage had run. Its instinct
+ * was not: the old mechanism could not tell a real completion from a fabricated one, which is exactly
+ * what a cross-family reviewer had already filed against the `fleet` stage. So the subagent now runs
+ * THIS, and the verification lives in code under test instead of in the wording of a prompt.
+ *
+ * It measures `--artifact` paths on disk itself. A caller cannot assert presence; it can only name
+ * what must be there.
+ */
+function cmdFeatureAdrCheckpoint(options: Map<string, string>, flags: Set<string>, cwd: string, write: Write): number {
+  const json = flags.has('json');
+  const emit = (payload: Record<string, unknown>, human: string, code: number): number => {
+    if (json) write(JSON.stringify(payload));
+    else write(human);
+    return code;
+  };
+  const slug = (options.get('slug') ?? '').trim();
+  const stage = (options.get('stage') ?? '').trim();
+  const inputHash = (options.get('input-hash') ?? '').trim();
+  const resultRaw = options.get('result') ?? '';
+  const artifacts = (options.get('artifact') ?? '')
+    .split(',')
+    .map((a) => a.trim())
+    .filter((a) => a !== '');
+  if ((slug === '' && (options.get('feature-dir') ?? '').trim() === '') || stage === '' || inputHash === '') {
+    return emit({ ok: false, reason: 'usage' }, 'dz feature-adr checkpoint: --stage, --input-hash and one of --slug / --feature-dir are required', 2);
+  }
+  let result: unknown;
+  try {
+    result = JSON.parse(resultRaw);
+  } catch {
+    return emit({ ok: false, reason: 'result is not valid JSON' }, 'dz feature-adr checkpoint: --result must be valid JSON', 2);
+  }
+  // --feature-dir wins when given: the workflow knows the absolute path already, and depending on
+  // cwd resolution there would make the command's behaviour depend on where the subagent happened to
+  // stand. --slug stays for humans running this by hand from a repo root.
+  const explicitDir = (options.get('feature-dir') ?? '').trim();
+  const featureDir = explicitDir !== '' ? explicitDir : join(cwd, 'features', slug);
+  // MEASURE, never trust: presence is established here, by this process, on this disk.
+  const present = artifacts.filter((rel) => {
+    const abs = join(featureDir, rel);
+    try {
+      return statSync(abs).isFile();
+    } catch {
+      return false;
+    }
+  });
+  const verdict = decideCheckpointWrite({ stage, inputHash, result, artifacts, present });
+  if (!verdict.ok) {
+    return emit({ ok: false, stage, reason: verdict.reason }, 'dz feature-adr checkpoint: REFUSED — ' + verdict.reason, 1);
+  }
+  const stateDir = join(featureDir, '.fa-state');
+  try {
+    mkdirSync(stateDir, { recursive: true });
+    appendFileSync(join(stateDir, 'checkpoints.jsonl'), verdict.line + '\n', 'utf-8');
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    return emit({ ok: false, stage, reason }, 'dz feature-adr checkpoint: write failed — ' + reason, 1);
+  }
+  return emit(
+    { ok: true, stage, witnessed: verdict.witnessed },
+    'dz feature-adr checkpoint: recorded ' + stage + ' (witnessed ' + verdict.witnessed.length + ' artifact(s))',
+    0,
+  );
+}
+
 function cmdReqe(options: Map<string, string>, flags: Set<string>, cwd: string, write: Write): number {
   const json = flags.has('json');
   if (flags.has('help')) {
@@ -11697,6 +11775,8 @@ export async function runCli(argv: string[], io: CliIo = {}): Promise<number> {
         return cmdEpochReplay(options, flags, cwd, write);
       case 'score':
         return cmdScore(options, flags, cwd, write);
+      case 'feature-adr-checkpoint':
+        return cmdFeatureAdrCheckpoint(options, flags, cwd, write);
       case 'reqe':
         return cmdReqe(options, flags, cwd, write);
       case 'qe-bridge':

package/src/core-compat.ts

@@ -44,7 +44,7 @@ import { fileURLToPath } from 'node:url';
  * standing test (`test/core-import-floor.test.ts`, F1) fails if the two drift apart,
  * because a guard that says 0.4.7 while npm may install 0.4.2 is worse than no guard.
  */
-export const MIN_CORE = '0.5.4';
+export const MIN_CORE = '0.6.0';
 
 /** The npm name of the guarded package — one literal, used by every leg below. */
 export const CORE_PACKAGE_NAME = '@dzhechkov/harness-core';