@kodevibe/harness 0.11.4 → 0.11.5

package/README.ko.md

@@ -201,7 +201,7 @@ npm run harness:llm-bench:real
 
 | IDE | 이럴 때 고르세요 | 디스패처 (always-on) | 스킬 | 에이전트 |
 |-----|--------------------|---------------------|------|----------|
-| **VS Code Copilot** | VS Code를 주로 쓰고 GitHub Copilot Chat 사용. | `.github/copilot-instructions.md` | `.github/skills/*/SKILL.md` | `.github/agents/*.agent.md` |
+| **VS Code Copilot** | VS Code를 주로 쓰고 GitHub Copilot Chat 사용. | `.github/copilot-instructions.md` (+ 짧은 `AGENTS.md` anchor) | `.github/skills/*/SKILL.md` | `.github/agents/*.agent.md` |
 | **Claude Code** | 터미널/Claude Code CLI 선호. | `CLAUDE.md` (+ `.claude/rules/core.md`) | `.claude/skills/*/SKILL.md` | `.claude/agents/*.md` |
 | **Cursor** | Cursor 에디터 사용. | `.cursor/rules/core.mdc` (+ `AGENTS.md`) | `.agents/skills/*/SKILL.md` (cross-tool) | `.cursor/rules/<agent>.mdc` |
 | **Codex** | OpenAI Codex CLI 서브에이전트 사용. | `AGENTS.md` | `.agents/skills/*/SKILL.md` | `.codex/agents/*.toml` |
@@ -409,7 +409,7 @@ Bootstrap이 `docs/crew/`, `docs/PM/`, `docs/Analyst/`, `docs/ARB/`에서 crew
 
 ## 로드맵
 
-kode:harness는 현재 **v0.11.4** — v0.11 proof-first 기반 위에 R16 recovery hardening(거짓 clean state-check claim, surface-specific Story Contract, reviewer dependency evidence, dirty wrap-up guard)을 추가했습니다.
+kode:harness는 현재 **v0.11.5** — R16 recovery guard 기반 위에 R17 governance hardening(Crew Validation Tracker drift, dependency-map interface log drift, VS Code root instruction anchoring)을 추가했습니다.
 
 | 단계 | 버전 | 상태 | 초점 |
 |------|------|------|------|
@@ -427,7 +427,8 @@ kode:harness는 현재 **v0.11.4** — v0.11 proof-first 기반 위에 R16 recov
 | **Uninstall Safety** | v0.11.1 | ✅ 완료 | Manifest 기반 uninstall, state 기본 보존, shared owner 복원, purge cleanup |
 | **Deterministic Release Guard** | v0.11.2 | ✅ 완료 | R1-R10 guard scripts, package-boundary scan, dependency-map scan, R10 manifest-sealed bench workflow |
 | **Experiment Hardening** | v0.11.3 | ✅ 완료 | R15 Recent Changes integrity, Wave Scope boundary drift checks, enum/filter coverage honesty |
-| **Recovery Hardening** | v0.11.4 | ✅ 현재 | R16 false PASS claim guard, surface-specific Story Contract checks, reviewer dependency evidence, dirty wrap-up guard |
+| **Recovery Hardening** | v0.11.4 | ✅ 완료 | R16 false PASS claim guard, surface-specific Story Contract checks, reviewer dependency evidence, dirty wrap-up guard |
+| **Governance Hardening** | v0.11.5 | ✅ 현재 | R17 Crew Validation Tracker sync, dependency-map interface log guard, VS Code AGENTS.md instruction anchor |
 | **Docs Bridge** | v0.11.1 | 🧪 Experimental | Project Docs Hub Index, docs-bridge 스킬, visibility 경계를 가진 로컬 docs hub 인덱스 |
 | **Safety & Branding** | v0.9.6 | ✅ 완료 | init overwrite 백업, 배포 파일 pm 네이밍 정리, LICENSE 브랜딩 정리 |
 | **Validation** | v1.0 | 🔜 다음 | 실사용 검증, 사용자 피드백 수집 |

package/README.md

@@ -211,7 +211,7 @@ Not sure which to pick? Use the IDE you already code in — each install path is
 
 | IDE | Pick this if… | Dispatcher (always-on) | Skills | Agents |
 |-----|---------------|----------------------|--------|--------|
-| **VS Code Copilot** | You use VS Code daily and have GitHub Copilot Chat. | `.github/copilot-instructions.md` | `.github/skills/*/SKILL.md` | `.github/agents/*.agent.md` |
+| **VS Code Copilot** | You use VS Code daily and have GitHub Copilot Chat. | `.github/copilot-instructions.md` (+ short `AGENTS.md` anchor) | `.github/skills/*/SKILL.md` | `.github/agents/*.agent.md` |
 | **Claude Code** | You prefer Claude in the terminal / Claude Code CLI. | `CLAUDE.md` (+ `.claude/rules/core.md`) | `.claude/skills/*/SKILL.md` | `.claude/agents/*.md` |
 | **Cursor** | You use Cursor as your editor. | `.cursor/rules/core.mdc` (+ `AGENTS.md`) | `.agents/skills/*/SKILL.md` (cross-tool) | `.cursor/rules/<agent>.mdc` |
 | **Codex** | You use OpenAI Codex CLI subagents. | `AGENTS.md` | `.agents/skills/*/SKILL.md` | `.codex/agents/*.toml` |
@@ -389,7 +389,7 @@ It adds a Project Docs Hub Index to `project-brief.md` with each local source, r
 
 ## Roadmap
 
-kode:harness is at **v0.11.4** — adds R16 recovery hardening for false clean state-check claims, surface-specific Story Contracts, reviewer dependency evidence, and dirty wrap-up truthfulness on top of the v0.11 proof-first and deterministic release guard foundation.
+kode:harness is at **v0.11.5** — adds R17 governance hardening for Crew Validation Tracker drift, dependency-map interface log drift, and VS Code root instruction anchoring on top of the R16 recovery guard foundation.
 
 | Phase | Version | Status | Focus |
 |---|---|---|---|
@@ -407,7 +407,8 @@ kode:harness is at **v0.11.4** — adds R16 recovery hardening for false clean s
 | **Uninstall Safety** | v0.11.1 | ✅ Complete | Manifest-based uninstall, default state preservation, shared owner restore, purge cleanup |
 | **Deterministic Release Guard** | v0.11.2 | ✅ Complete | R1-R10 guard scripts, package-boundary scan, dependency-map scan, R10 manifest-sealed bench workflow |
 | **Experiment Hardening** | v0.11.3 | ✅ Complete | R15 Recent Changes integrity, Wave Scope boundary drift checks, enum/filter coverage honesty, R15 bench scenarios |
-| **Recovery Hardening** | v0.11.4 | ✅ Current | R16 false PASS claim guard, surface-specific Story Contract checks, reviewer dependency evidence, dirty wrap-up guard |
+| **Recovery Hardening** | v0.11.4 | ✅ Complete | R16 false PASS claim guard, surface-specific Story Contract checks, reviewer dependency evidence, dirty wrap-up guard |
+| **Governance Hardening** | v0.11.5 | ✅ Current | R17 Crew Validation Tracker sync, dependency-map interface log guard, VS Code AGENTS.md instruction anchor |
 | **Docs Bridge** | v0.11.1 | 🧪 Experimental | Project Docs Hub Index, docs-bridge skill, local docs hub index with visibility boundaries |
 | **Safety & Branding** | v0.9.6 | ✅ Done | init overwrite backups, shipped pm naming cleanup, LICENSE branding cleanup |
 | **Validation** | v1.0 | 🔜 Next | Real-world project adoption, user feedback collection |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kodevibe/harness",
-  "version": "0.11.4",
+  "version": "0.11.5",
   "description": "kode:harness — harness engineering for keeping every developer's AI aligned on one project direction.",
   "keywords": [
     "llm",

package/src/guard.js

@@ -23,6 +23,8 @@
 //   R15 checkRecentChangesIntegrity — wrap-up must not corrupt state sections
 //   R16 checkSelfVerifyClaim — claimed PASS must match deterministic guard
 //   R16 checkReviewerAuditEvidence — scope audits must cite real deps/imports
+//   R17 checkCrewValidationSync — Crew Validation Tracker follows done work
+//   R17 checkDependencyInterfaceLog — interface-affecting features update deps
 //
 // Severity: 'error' blocks the commit (exit 1). 'warn' is informational.
 
@@ -522,7 +524,7 @@ function checkLearnCompletion({ projectState = '', features = '', quiet = false
 
 function splitPathList(value) {
   return String(value || '')
-    .split(/[,;<br>`]+|\s{2,}/)
+    .split(/(?:,|;|<br\s*\/?>|`)+|\s{2,}/i)
     .map((v) => v.trim())
     .filter((v) => v && !/^n\/a$/i.test(v) && !/^\(?none\)?$/i.test(v));
 }
@@ -584,6 +586,124 @@ function checkStateSync({ projectState = '', features = '', dependencyMap = '' }
   return violations;
 }
 
+// ─── Crew Validation Tracker Sync Gate (R17) ────────────────────────
+
+const COMPLETE_STATUS = /✅|done|proven|pass(?:ed)?|reviewed|complete|완료|통과/i;
+const INCOMPLETE_STATUS = /planned|pending|todo|not[_ -]?proven|not[_ -]?verified|⬜|🟡|🔄|대기|계획|미완료/i;
+const REQUIREMENT_ID_RE = /\b(?:FR|KPI|ARB|ARB-FAIL)[-_]?\d+\b/gi;
+const BASELINE_REQUIREMENTS = new Set(['FR-001', 'FR-002']);
+
+function normalizedRequirementId(value) {
+  return String(value || '').toUpperCase().replace('_', '-');
+}
+
+function extractRequirementIds(value) {
+  return [...new Set((String(value || '').match(REQUIREMENT_ID_RE) || [])
+    .map(normalizedRequirementId))];
+}
+
+function trackerRowsFromBrief(projectBrief = '') {
+  const visible = stripHtmlComments(projectBrief);
+  const section = getSection(visible, 'Validation Tracker') || '';
+  return parseMarkdownTable(section);
+}
+
+function trackerRequirement(row) {
+  return row.Requirement || row.FR || row.KPI || row.ARB || row.Item || row.Control || '';
+}
+
+function trackerStory(row) {
+  return row.Story || row.Stories || row['Story ID'] || '';
+}
+
+function trackerStatus(row) {
+  return row.Status || row.status || '';
+}
+
+/**
+ * Crew mode adds project-brief.md Validation Tracker as the FR/KPI/ARB source
+ * of truth. A recurring Qwen failure was marking features/project-state done
+ * while leaving tracker rows Planned. This gate makes that drift blocking.
+ *
+ * @param {{projectState?: string, features?: string, projectBrief?: string}} files
+ * @returns {Array}
+ */
+function checkCrewValidationSync({ projectState = '', features = '', projectBrief = '' } = {}) {
+  const violations = [];
+  const trackerRows = trackerRowsFromBrief(projectBrief);
+  if (trackerRows.length === 0) return violations;
+
+  const doneStoryIds = parseMarkdownTable(getSection(stripHtmlComments(projectState), 'Story Status') || '')
+    .filter((row) => /✅\s*done/i.test(rowStatus(row)))
+    .map((row) => storyIdFromRow(row))
+    .filter(Boolean);
+  const doneStorySet = new Set(doneStoryIds);
+
+  const featureRows = parseMarkdownTable(getSection(stripHtmlComments(features), 'Feature Registry') || stripHtmlComments(features))
+    .filter((row) => COMPLETE_STATUS.test(row.Status || row.status || ''));
+  const doneRequirements = new Set();
+  for (const feature of featureRows) {
+    const raw = Object.values(feature).filter((v) => typeof v === 'string').join(' ');
+    for (const req of extractRequirementIds(raw)) doneRequirements.add(req);
+  }
+
+  for (const row of trackerRows) {
+    const req = normalizedRequirementId(trackerRequirement(row));
+    const story = trackerStory(row);
+    const status = trackerStatus(row);
+    const mappedToDoneStory = [...doneStorySet].some((id) => story.includes(id));
+    const doneByFeature = req && doneRequirements.has(req);
+    if ((mappedToDoneStory || doneByFeature) && INCOMPLETE_STATUS.test(status)) {
+      violations.push({
+        check: 'validation-tracker',
+        severity: 'error',
+        line: 0,
+        message: `Validation Tracker row ${req || '(unknown requirement)'} maps to completed work but still has status "${status || 'blank'}" (R17). Update project-brief.md to Proven/Done or keep the Story out of Done.`,
+      });
+    }
+  }
+
+  return violations;
+}
+
+// ─── Dependency Interface Log Gate (R17) ────────────────────────────
+
+const INTERFACE_FEATURE_TERMS = /\b(FR-00[3-9]|FR-0[1-9]\d|sla|risk|filter|api|interface|contract|auth|login|board|control)\b/i;
+
+function checkDependencyInterfaceLog({ features = '', dependencyMap = '' } = {}) {
+  const violations = [];
+  const depVisible = stripHtmlComments(dependencyMap);
+  const interfaceLog = getSection(depVisible, 'Interface Change Log');
+  if (interfaceLog === null) return violations;
+
+  const featureRows = parseMarkdownTable(getSection(stripHtmlComments(features), 'Feature Registry') || stripHtmlComments(features))
+    .filter((row) => COMPLETE_STATUS.test(row.Status || row.status || ''));
+
+  for (const row of featureRows) {
+    const raw = Object.values(row).filter((v) => typeof v === 'string').join(' ');
+    const requirements = extractRequirementIds(raw).filter((id) => !BASELINE_REQUIREMENTS.has(id));
+    const keyFiles = row['Key Files'] || row['Key files'] || row.Files || row.Scope || '';
+    const touchesSource = splitPathList(keyFiles).some((file) => /^(src|lib|app|public)\//.test(file) || /^(server|index)\.js$/.test(file));
+    const interfaceLike = requirements.length > 0 || INTERFACE_FEATURE_TERMS.test(raw);
+    if (!touchesSource || !interfaceLike) continue;
+
+    const coveredByRequirement = requirements.some((req) => interfaceLog.includes(req));
+    const featureName = row.Feature || row.Name || row.Title || '';
+    const tokens = String(featureName).toLowerCase().match(/[a-z0-9-]{4,}/g) || [];
+    const meaningfulMatches = tokens.filter((token) => interfaceLog.toLowerCase().includes(token));
+    if (!coveredByRequirement && meaningfulMatches.length < 2) {
+      violations.push({
+        check: 'dependency-interface-log',
+        severity: 'error',
+        line: 0,
+        message: `Completed feature "${featureName || '(unnamed feature)'}" changes source/API/UI surfaces but dependency-map.md Interface Change Log has no matching FR/feature entry (R17). Add an interface log row or explicitly record no interface change.`,
+      });
+    }
+  }
+
+  return violations;
+}
+
 // ─── Scope Split Approval Gate (R14) ────────────────────────────────
 
 const STORY_ID_RE = /\bS\d+-\d+\b/g;
@@ -1131,6 +1251,7 @@ function sourceFilesForAudit(cwd) {
 function runGuard({ files, cwd = process.cwd() }) {
   const all = [];
   let scanned = 0;
+  const stateContents = {};
 
   for (const file of files) {
     const abs = path.isAbsolute(file) ? file : path.join(cwd, file);
@@ -1139,6 +1260,11 @@ function runGuard({ files, cwd = process.cwd() }) {
     const rel = path.relative(cwd, abs);
     scanned++;
     const beforeFile = all.length;
+    const normalizedRel = rel.replace(/\\/g, '/');
+    if (/^(docs|\.harness)\/project-state\.md$/.test(normalizedRel)) stateContents.projectState = content;
+    if (/^(docs|\.harness)\/features\.md$/.test(normalizedRel)) stateContents.features = content;
+    if (/^(docs|\.harness)\/dependency-map\.md$/.test(normalizedRel)) stateContents.dependencyMap = content;
+    if (/^(docs|\.harness)\/project-brief\.md$/.test(normalizedRel)) stateContents.projectBrief = content;
 
     if (isScannableForSecrets(file)) {
       all.push(...scanSecrets(content, rel));
@@ -1179,6 +1305,14 @@ function runGuard({ files, cwd = process.cwd() }) {
     }
   }
 
+  if (stateContents.projectState && stateContents.features && stateContents.dependencyMap) {
+    all.push(...checkStateSync(stateContents));
+    all.push(...checkDependencyInterfaceLog(stateContents));
+  }
+  if (stateContents.projectState && stateContents.features && stateContents.projectBrief) {
+    all.push(...checkCrewValidationSync(stateContents));
+  }
+
   const errorCount = all.filter((v) => v.severity === 'error').length;
   const warnCount = all.filter((v) => v.severity === 'warn').length;
   return { ok: errorCount === 0, violations: all, errorCount, warnCount, scanned };
@@ -1191,6 +1325,8 @@ module.exports = {
   checkStoryContracts,
   checkLearnCompletion,
   checkStateSync,
+  checkCrewValidationSync,
+  checkDependencyInterfaceLog,
   checkScopeSplitApproval,
   checkRecentChangesIntegrity,
   checkSelfVerifyClaim,

package/src/init.js

@@ -338,6 +338,24 @@ function writeAgentsAsToml(targetDir, agentsDir, overwrite, mode = 'solo', crew
   }
 }
 
+function vscodeAgentsMirror() {
+  return [
+    '# kode:harness VS Code Instruction Anchor',
+    '',
+    'This project uses kode:harness. The canonical VS Code Copilot dispatcher is `.github/copilot-instructions.md` and must be followed.',
+    '',
+    'Hard stops:',
+    '',
+    '- Read `docs/project-state.md` before planning or coding.',
+    '- Every response must end with a `🧭 Next Step` block.',
+    '- Do not mark a Story Done without Proof Ledger evidence.',
+    '- Do not claim state-check/guard PASS without real command output.',
+    '- Do not claim clean worktree, commit, push, publish, or policy compliance without checking the actual command result.',
+    '- Security, governance, dependency, CI/CD, and release rules are enforced by deterministic guards; if guard output conflicts with prose, guard output wins.',
+    '',
+  ].join('\n');
+}
+
 // ─── IDE Generators ──────────────────────────────────────────
 
 function generateVscode(targetDir, overwrite, mode = 'solo', crew = false) {
@@ -345,6 +363,9 @@ function generateVscode(targetDir, overwrite, mode = 'solo', crew = false) {
 
   // Global instructions (dispatcher only — rules are embedded in skills)
   writeFile(targetDir, '.github/copilot-instructions.md', coreRules, true);
+  // Root AGENTS.md mirror — VS Code now supports AGENTS.md as an instruction
+  // surface. Keep it short to avoid conflicting with the canonical dispatcher.
+  writeFile(targetDir, 'AGENTS.md', vscodeAgentsMirror(), true);
 
   // Skills (.github/skills — VS Code default search path, SKILL.md with frontmatter)
   writeSkills(targetDir, '.github/skills', true, mode, crew);