agentic-engineering-harness 0.6.28 → 0.6.29

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-engineering-harness",
-  "version": "0.6.28",
+  "version": "0.6.29",
   "description": "OSS-first engineering harness for deterministic, spec-driven, issue-driven, audit-governed and orchestration-first multi-agent software delivery.",
   "type": "module",
   "bin": {

package/policies/core/trust-boundary.rego

@@ -3,15 +3,25 @@ package harness.trust_boundary
 # Input shape expected from the harness policy adapter:
 # {
 #   "changedFiles": [...],
-#   "frozenPatterns": [...],
-#   "workerRole": "implementation-worker"
+#   "frozenChangedFiles": [...],
+#   "identity": {"logicalAgent": "...", "role": "...", "permissions": {...}}
 # }
 #
 # Pattern expansion is intentionally performed by the harness before OPA.
 
 default allow := true
 
-deny contains "implementation worker changed a frozen artifact" if {
-  input.workerRole == "implementation-worker"
+deny contains "implementation agent changed a frozen artifact" if {
+  input.identity.role == "implementer"
   count(input.frozenChangedFiles) > 0
 }
+
+deny contains "read-only role has write permission" if {
+  input.identity.role == "reviewer"
+  input.identity.permissions.write == "allow"
+}
+
+deny contains "network permission is forbidden for high-risk execution" if {
+  input.identity.risk == "high"
+  input.identity.permissions.network == "allow"
+}

package/templates/project.yaml

@@ -306,6 +306,10 @@ evals:
   workspacesDir: .harness/evals/workspaces
   defaultRuns: 5
   confidenceLevel: 0.95
+  fullStack:
+    enabled: false
+    required: false
+    strictSupplyChain: false
 
 provenance:
   outputDir: .harness/provenance

package/templates/toolchain.yaml

@@ -113,8 +113,8 @@ tools:
   serena:
     kind: mise
     command: serena
-    source: "pipx:serena"
-    version: "1.5.3"
+    source: "pipx:serena-agent"
+    version: "1.6.1"
     required: true
     dependsOn: [uv, python]
     activateWhen: [semantic-retrieval:serena]
@@ -123,11 +123,18 @@ tools:
     kind: mise
     command: headroom
     source: "pipx:headroom-ai[all]"
-    version: "0.27.0"
+    version: "0.28.0"
     required: true
     dependsOn: [uv, python]
     activateWhen: [compression:headroom]
 
+  engram:
+    kind: mise
+    command: engram
+    source: "npm:@engram-ai-memory/cli"
+    version: latest
+    activateWhen: [memory:engram]
+
   opa:
     kind: mise
     command: opa