@dzhechkov/harness-core 0.8.2 → 0.8.5

package/src/deadwood-allowlist.json

@@ -0,0 +1,80 @@
+{
+  "v": 1,
+  "entries": [
+    {
+      "surface": "sign",
+      "kind": "command",
+      "reason": "trust-root signing and verification run only on key or release events; rarity is the design"
+    },
+    {
+      "surface": "delivery-check",
+      "kind": "command",
+      "reason": "release gate invoked per delivery, not as part of ordinary daily command traffic"
+    },
+    {
+      "surface": "deadwood",
+      "kind": "command",
+      "reason": "the measurement command deliberately does not record itself, so its zero count is structural"
+    },
+    {
+      "surface": "no-secrets",
+      "kind": "rule",
+      "reason": "credential safety net whose zero-firing state is the healthy outcome"
+    },
+    {
+      "surface": "no-workspace-star",
+      "kind": "rule",
+      "reason": "publish safety net; zero firings means no broken workspace dependency would ship"
+    },
+    {
+      "surface": "no-skill-drift",
+      "kind": "rule",
+      "reason": "canonical-copy safety net; zero firings means projected skills stayed in sync"
+    },
+    {
+      "surface": "readme-consistency",
+      "kind": "rule",
+      "reason": "documentation drift safety net; zero firings means measured counts stayed aligned"
+    },
+    {
+      "surface": "skills-registrable",
+      "kind": "rule",
+      "reason": "package registration safety net; zero firings means shipped skill layouts stayed loadable"
+    },
+    {
+      "surface": "readme-first",
+      "kind": "rule",
+      "reason": "release documentation safety net; zero firings means behavior changes carried their README update"
+    },
+    {
+      "surface": "agents-md-policy-sync",
+      "kind": "rule",
+      "reason": "governance projection safety net; zero firings means policy copies stayed synchronized"
+    },
+    {
+      "surface": "lockfile-in-sync",
+      "kind": "rule",
+      "reason": "dependency release safety net; zero firings means package manifests and the lockfile agreed"
+    },
+    {
+      "surface": "store-bloat-cap",
+      "kind": "rule",
+      "reason": "learning-store capacity safety net; zero firings means the configured cap was respected"
+    },
+    {
+      "surface": "no-stubs",
+      "kind": "rule",
+      "reason": "incomplete-source safety net; zero firings means no unfinished implementation marker reached publish"
+    },
+    {
+      "surface": "review-round",
+      "kind": "rule",
+      "reason": "independent-review safety net evaluated only for publishable source changes"
+    },
+    {
+      "surface": "licence-hold",
+      "kind": "rule",
+      "reason": "release safety net that fires only while a package has an unresolved licence grant"
+    }
+  ]
+}

package/src/feature-adr-routing.ts

@@ -389,7 +389,16 @@ export function codexEffortHint(opts: StageOpts | null | undefined): string {
 
 // ── Step-7.5 CODE landed barrier (Codex out-of-band write flush) ────────────
 
-export const DEFAULT_CODE_LANDING_MAX_WAIT_MS = 120_000;
+// Widened 2026-08-28 (MEASURED, not a guess): the dz-deadwood coder job ran 46m11s end to end, and
+// the slop-lint coder was independently confirmed STILL RUNNING (codex-companion status "running",
+// pid alive, mid-TDD-cycle, actively applying file changes) at 16m38s elapsed — a full 8x past the
+// old 120s window. The old window declared "genuinely not landed" and fed Step-8 QE a false empty
+// tree, producing a grade-D report entirely about an absence that was never real. This does not fix
+// the underlying conflation of TIMEOUT with CONFIRMED-ABSENCE (filed as a backlog item — the barrier
+// still cannot see the codex-companion job's own liveness) — it only narrows how often the false
+// negative fires for a realistic M-tier build, at the cost of a longer worst-case wait when the
+// coder truly produced nothing.
+export const DEFAULT_CODE_LANDING_MAX_WAIT_MS = 1_020_000;
 
 export const DEFAULT_CODE_LANDING_BACKOFF_MS = [
   1_000,
@@ -403,6 +412,17 @@ export const DEFAULT_CODE_LANDING_BACKOFF_MS = [
   20_000,
   25_000,
   25_000,
+  30_000,
+  30_000,
+  60_000,
+  60_000,
+  60_000,
+  90_000,
+  90_000,
+  120_000,
+  120_000,
+  120_000,
+  120_000,
 ] as const;
 
 export const CODE_LANDED_BARRIER_SLEEPS_SECONDS = DEFAULT_CODE_LANDING_BACKOFF_MS.map((ms) => ms / 1000);

package/src/index.ts

@@ -224,6 +224,28 @@ export type { PretrainResult, DetectedTech } from './pretrain.js';
 export type { RecommendationReport, SkillRecommendation } from './recommend.js';
 export { claimCheck, summarize, decideClaimCheckText, severityCounts, isGated } from './claim-check.js';
 export type { ClaimFinding, ClaimCheckResult, ClaimTextDecision, FailOn } from './claim-check.js';
+export {
+  BUNDLED_SLOP_REGISTRY_URL,
+  DEFAULT_SLOP_CONFIG,
+  parseSlopRegistry,
+  slopLint,
+  validateSlopLintConfig,
+} from './slop-lint.js';
+export type {
+  SlopDiagnostic,
+  SlopEvidence,
+  SlopFinding,
+  SlopFindingMetrics,
+  SlopFindingThresholds,
+  SlopLanguage,
+  SlopLintConfig,
+  SlopLintResult,
+  SlopRegistry,
+  SlopRegistryEntry,
+  SlopRuleId,
+  SlopValidationError,
+  ValidationResult,
+} from './slop-lint.js';
 export { hookDecision, isFenced, isNewLine, ESCAPE_TEACHING } from './claim-check-hook-policy.js';
 export type { HookDecision, HookDecisionOpts } from './claim-check-hook-policy.js';
 export { step8ClaimGate } from './feature-adr-claim-gate.js';
@@ -290,6 +312,35 @@ export { decidePublishSigning, decidePostSigningVerification, decideSignableSet,
 export type { PublishSigningVerdict, PublishSigningDecision, SignableSetDecision } from './publish-signing.js';
 export type { RecordKind, RecordVerdict, RecordDecision } from './run-records.js';
 export type { AmendmentRow, AmendmentVerdict, AmendmentResolution, AmendmentOutcome, AmendmentDecision, PlanCoverageGap } from './amendment-trace.js';
+// contract-checklist (ADR-001): pure extraction, canonical rendering, typed report parsing, and
+// exact per-item verification. Filesystem discovery/containment stays in harness-cli.
+export {
+  extractContractChecklist,
+  renderContractChecklist,
+  parseContractVerdictReport,
+  verifyContractVerdicts,
+} from './contract-checklist.js';
+export type {
+  ContractSourceKind,
+  ContractVerdict,
+  ContractObservedOutcome,
+  ContractGrade,
+  ContractSourceArtifact,
+  ContractChecklistSource,
+  ContractItem,
+  ContractChecklist,
+  ContractDiagnostic,
+  ContractChecklistResult,
+  ContractVerdictEvidence,
+  ContractVerdictItem,
+  ContractVerdictReport,
+  ContractVerdictParseResult,
+  ContractEvidenceReadResult,
+  ContractEvidenceReader,
+  ContractItemVerification,
+  ContractVerificationCounts,
+  ContractVerification,
+} from './contract-checklist.js';
 export {
   DOMAIN_LIFT_EXACT,
   DOMAIN_LIFT_RELATED,
@@ -792,6 +843,9 @@ export * from './skills-verify.js';
 // finding, not a pass).
 export * from './compounding.js';
 
+// Advisory command-invocation telemetry + deadwood report (feature dz-deadwood).
+export * from './cmd-usage.js';
+
 // Cold-vs-warm EPOCH RUNNER (feature epoch-replay, scout idea #4) — the RESULT leg to compounding's
 // readiness leg. Orchestrates + scores; never calls a model. SUPPORTED requires two DISJOINT Wilson
 // intervals; INCONCLUSIVE is a first-class honest outcome.
@@ -872,6 +926,31 @@ export { decideCadenceWindow, isoWeekOf, weeklyBuckets, guardRepeatDecay, buildC
 export type { CadenceWindow, CadenceReport, CadenceWindowDecision } from './cadence.js';
 export { readQeRounds, countQeRounds, QE_ROUNDS_DEFAULT_CEILING } from './qe-rounds.js';
 export type { QeRound, QeFailedAttempt, QeRoundsReport, QeRoundsStatus } from './qe-rounds.js';
+export {
+  adviseRestart,
+  decideRestartRecommendation,
+  parseCheckpointQeHistory,
+  parseTrainingPairQeHistory,
+  renderRestartDecisionLog,
+  RESTART_ADVISOR_SCHEMA,
+  RESTART_ADVISOR_MAX_DIAGNOSTICS,
+  RESTART_ADVISOR_MAX_EVIDENCE,
+} from './restart-advisor.js';
+export type {
+  ParsedRestartHistory,
+  RestartAdvice,
+  RestartAdvisorInput,
+  RestartAdvisorPolicy,
+  RestartDecision,
+  RestartDecisionInput,
+  RestartGrade,
+  RestartNormalizedRound,
+  RestartPolicyOrigin,
+  RestartReason,
+  RestartRecommendation,
+  RestartSource,
+  RestartThreshold,
+} from './restart-advisor.js';
 export { describeStoreLocation, storeLocationLine } from './store-location.js';
 export type { StoreLocation, StoreOrigin } from './store-location.js';
 export { mergeStoreHits, sameStore, globalStoreRoot, storeCountLabel } from './store-merge.js';

package/src/qe-bridge.ts

@@ -392,6 +392,15 @@ export function buildBridgePrompt(
     '4. Judge only what the extracts below actually show; if the evidence is insufficient to judge',
     '   something, say so explicitly rather than assuming it is fine.',
     '',
+    'You have been given NO tools and NO filesystem access — this is deliberate isolation, not an',
+    'accident, and there is nothing else to inspect. Do not attempt to run a shell command, read a',
+    'file, or explore a directory: no such action can succeed here, and any text that looks like a',
+    'tool invocation will simply sit in your own output unexecuted. The extracts below are the',
+    'COMPLETE evidence you will ever receive for this review. If they are insufficient to judge a',
+    'specific point, write that as a finding (e.g. "cannot verify X from the given extracts") and',
+    'continue to a grade regardless — never stop your review to attempt verification that cannot',
+    'happen in this environment.',
+    '',
     'Output format — ALL THREE parts are required, in this order, at the END of your answer:',
     '  (a) your review prose, containing exactly ONE line that reads:  GRADE: <A-F>',
     '  (b) a fenced code block labelled ' + BRIDGE_FENCE_LABEL + ' whose body is JSON:',