agentic-engineering-harness 0.6.29 → 0.7.0

package/docs/COMPONENT_MATURITY.md

@@ -1,8 +1,12 @@
 # Component maturity at current `main`
 
 This matrix records the highest level supported by executable code and tests at
-the current revision. A roadmap checkbox means that a capability exists; it is
-not evidence that the capability is production-grade.
+the current revision. The machine-readable source is
+[`component-maturity.json`](component-maturity.json). A roadmap checkbox means
+that a capability exists; it is not evidence that the capability is
+production-grade.
+
+A roadmap checkbox means that a capability exists; it is not evidence that the capability is production-grade.
 
 Levels are cumulative: `DECLARED`, `ADAPTER`, `EXECUTABLE`,
 `WORKFLOW_INTEGRATED`, `DOGFOODED`, `EVAL_VALIDATED`, `PRODUCTION_GRADE`.
@@ -12,8 +16,8 @@ Levels are cumulative: `DECLARED`, `ADAPTER`, `EXECUTABLE`,
 | Paseo | WORKFLOW_INTEGRATED | `src/paseo`, Paseo runtime tests |
 | Codex CLI | WORKFLOW_INTEGRATED | `src/workers/agentPrompt.ts`, runtime invocation tests |
 | OpenCode | WORKFLOW_INTEGRATED | `src/agents/permissions.ts`, direct/Podman/Paseo tests |
-| Engram | WORKFLOW_INTEGRATED | `src/providers/engram.ts`, memory lifecycle tests |
-| Graphify | WORKFLOW_INTEGRATED | canonical provider/model, snapshots and scheduling tests |
+| Engram | WORKFLOW_INTEGRATED | `src/core/run.ts`, `src/memory/candidates.ts`, real CLI contract and full-stack fixture |
+| Graphify | WORKFLOW_INTEGRATED | provider-owned CLI lifecycle, canonical model, freshness metadata and real CLI contract |
 | OpenSpec | WORKFLOW_INTEGRATED | `src/spec`, OpenSpec bridge tests |
 | AEH SDD | WORKFLOW_INTEGRATED | `src/core/sdd.ts`, SDD tests |
 | TaskContracts | WORKFLOW_INTEGRATED | contract/seal and run tests |
@@ -21,20 +25,20 @@ Levels are cumulative: `DECLARED`, `ADAPTER`, `EXECUTABLE`,
 | Reqnroll | DECLARED | consumer-project capability; no AEH runtime dependency |
 | .NET/xUnit integration | EXECUTABLE | Gherkin/project validation path |
 | Testcontainers capability | DECLARED | consumer test capability; detected through project validation |
-| Playwright | WORKFLOW_INTEGRATED | normalized browser evidence adapter |
+| Playwright | WORKFLOW_INTEGRATED | pinned Chromium JSON-reporter contract and normalized browser evidence adapter |
 | Pact | ADAPTER | normalized contract evidence adapter; consumer runtime remains external |
 | OPA | WORKFLOW_INTEGRATED | typed execution identity and Rego policy path |
-| Opengrep | WORKFLOW_INTEGRATED | normalized security findings |
-| Trivy | WORKFLOW_INTEGRATED | normalized vulnerability/secret/misconfiguration findings and SBOM |
+| Opengrep | WORKFLOW_INTEGRATED | pinned CLI JSON contract and normalized security findings |
+| Trivy | WORKFLOW_INTEGRATED | pinned CLI JSON contract, strict full-stack validation, normalized vulnerability/secret/misconfiguration findings and SBOM |
 | Podman | WORKFLOW_INTEGRATED | hardened worker executor and sandbox tests |
-| OpenTelemetry | WORKFLOW_INTEGRATED | coherent operation trace IDs plus local NDJSON |
-| Engineering Evals | EVAL_VALIDATED | `src/evals`, `tests/evals.test.ts` |
+| OpenTelemetry | WORKFLOW_INTEGRATED | official SDK provider/context propagation plus local NDJSON |
+| Engineering Evals | DOGFOODED | deterministic production-path fixture in `src/evals/fullStack.ts` |
 | SBOM | EXECUTABLE | Trivy-backed provenance generation |
 | Cosign | EXECUTABLE | optional signing plus verification path |
 | in-toto/SLSA | EXECUTABLE | statement/predicate and manifest-chain generation |
 | ContextBudgetGateway | WORKFLOW_INTEGRATED | typed fragments in the actual agent prompt path |
-| Serena | ADAPTER | provider doctor/MCP projection; local installation is external |
-| Headroom | ADAPTER | controller-side compression provider; not exposed as runtime MCP |
+| Serena | WORKFLOW_INTEGRATED | pinned MCP initialize/tools/list/call contract and transport projection; local installation is external |
+| Headroom | EXECUTABLE | controller-side SDK bridge, real compression contract and full-stack fixture |
 | Repository Context Map | WORKFLOW_INTEGRATED | Graphify/filesystem map consumed by prompt preparation |
 | `aeh_context_retrieve` | WORKFLOW_INTEGRATED | authorization, path and SHA-256 checks |
 

package/docs/component-maturity.json

@@ -0,0 +1,34 @@
+{
+  "version": 1,
+  "levels": ["DECLARED", "ADAPTER", "EXECUTABLE", "WORKFLOW_INTEGRATED", "DOGFOODED", "EVAL_VALIDATED", "PRODUCTION_GRADE"],
+  "components": {
+    "Paseo": { "claimed": "WORKFLOW_INTEGRATED", "evidence": ["src/paseo", "tests/paseoRuntime.test.ts"] },
+    "Codex CLI": { "claimed": "WORKFLOW_INTEGRATED", "evidence": ["src/workers/direct.ts", "tests/runtimeInvocation.test.ts"] },
+    "OpenCode": { "claimed": "WORKFLOW_INTEGRATED", "evidence": ["src/agents/permissions.ts", "tests/opencodePaseoCapability.test.ts"] },
+    "Engram": { "claimed": "WORKFLOW_INTEGRATED", "evidence": ["src/core/run.ts", "src/memory/candidates.ts", "tests/providerContracts.test.ts", "src/evals/fullStack.ts"] },
+    "Graphify": { "claimed": "WORKFLOW_INTEGRATED", "evidence": ["src/providers/graphify.ts", "src/providers/graphifyModel.ts", "tests/providerContracts.test.ts", "src/evals/fullStack.ts"] },
+    "OpenSpec": { "claimed": "WORKFLOW_INTEGRATED", "evidence": ["src/spec", "tests/openSpecBridge.test.ts"] },
+    "AEH SDD": { "claimed": "WORKFLOW_INTEGRATED", "evidence": ["src/core/sdd.ts", "tests/sdd.test.ts"] },
+    "TaskContracts": { "claimed": "WORKFLOW_INTEGRATED", "evidence": ["src/core/seal.ts", "tests/verifyRoots.test.ts"] },
+    "Gherkin": { "claimed": "EXECUTABLE", "evidence": ["src/validators/gherkin.ts"] },
+    "Reqnroll": { "claimed": "DECLARED", "evidence": ["docs/COMPONENT_MATURITY.md"] },
+    ".NET/xUnit integration": { "claimed": "EXECUTABLE", "evidence": ["src/validators/commands.ts"] },
+    "Testcontainers capability": { "claimed": "DECLARED", "evidence": ["docs/COMPONENT_MATURITY.md"] },
+    "Playwright": { "claimed": "WORKFLOW_INTEGRATED", "evidence": ["src/validators/external.ts", "src/validators/toolEvidence.ts", "tests/providerContracts.test.ts", ".github/workflows/ci.yml"] },
+    "Pact": { "claimed": "ADAPTER", "evidence": ["src/validators/toolEvidence.ts"] },
+    "OPA": { "claimed": "WORKFLOW_INTEGRATED", "evidence": ["src/validators/opa.ts", "tests/architectureIntegrationContracts.test.ts"] },
+    "Opengrep": { "claimed": "WORKFLOW_INTEGRATED", "evidence": ["src/validators/external.ts", "src/validators/toolEvidence.ts", "tests/providerContracts.test.ts", ".github/workflows/ci.yml"] },
+    "Trivy": { "claimed": "WORKFLOW_INTEGRATED", "evidence": ["src/validators/external.ts", "src/validators/toolEvidence.ts", "tests/providerContracts.test.ts", "src/evals/fullStack.ts", ".github/workflows/ci.yml"] },
+    "Podman": { "claimed": "WORKFLOW_INTEGRATED", "evidence": ["src/workers/podman.ts"] },
+    "OpenTelemetry": { "claimed": "WORKFLOW_INTEGRATED", "evidence": ["src/telemetry/tracing.ts", "src/telemetry/events.ts"] },
+    "Engineering Evals": { "claimed": "DOGFOODED", "evidence": ["src/evals/fullStack.ts"] },
+    "SBOM": { "claimed": "EXECUTABLE", "evidence": ["src/provenance/generate.ts"] },
+    "Cosign": { "claimed": "EXECUTABLE", "evidence": ["src/provenance/generate.ts"] },
+    "in-toto/SLSA": { "claimed": "EXECUTABLE", "evidence": ["src/provenance/generate.ts"] },
+    "ContextBudgetGateway": { "claimed": "WORKFLOW_INTEGRATED", "evidence": ["src/context/gateway.ts", "src/workers/agentPrompt.ts"] },
+    "Serena": { "claimed": "WORKFLOW_INTEGRATED", "evidence": ["src/context/repository/serena.ts", "src/providers/serenaMcp.ts", "tests/providerContracts.test.ts", "src/context/transport.ts", ".github/workflows/ci.yml"] },
+    "Headroom": { "claimed": "EXECUTABLE", "evidence": ["src/context/compression/headroom.ts", "scripts/headroom-bridge.py", "tests/providerContracts.test.ts", "src/evals/fullStack.ts"] },
+    "Repository Context Map": { "claimed": "WORKFLOW_INTEGRATED", "evidence": ["src/context/repository/map.ts", "src/workers/agentPrompt.ts"] },
+    "aeh_context_retrieve": { "claimed": "WORKFLOW_INTEGRATED", "evidence": ["src/context/retrieval", "src/context/gateway.ts"] }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-engineering-harness",
-  "version": "0.6.29",
+  "version": "0.7.0",
   "description": "OSS-first engineering harness for deterministic, spec-driven, issue-driven, audit-governed and orchestration-first multi-agent software delivery.",
   "type": "module",
   "bin": {
@@ -15,6 +15,7 @@
     "schemas",
     "skills",
     "docs",
+    "scripts/headroom-bridge.py",
     "scripts/link-self-bin.mjs"
   ],
   "scripts": {
@@ -35,12 +36,17 @@
   },
   "dependencies": {
     "@opentelemetry/api": "^1.9.0",
+    "@opentelemetry/context-async-hooks": "^2.10.0",
+    "@opentelemetry/exporter-trace-otlp-http": "^0.206.0",
+    "@opentelemetry/resources": "^2.10.0",
+    "@opentelemetry/sdk-trace-node": "^2.10.0",
     "commander": "^14.0.1",
     "minimatch": "^10.0.3",
     "yaml": "^2.8.1",
     "zod": "^4.0.17"
   },
   "devDependencies": {
+    "@playwright/test": "1.62.1",
     "@types/node": "^24.2.1",
     "agentic-engineering-harness": "^0.6.27",
     "tsx": "^4.20.3",

package/schemas/project.schema.json

@@ -47,7 +47,7 @@
     } },
     "delivery": { "type": "object", "properties": { "stateDir": { "type": "string" }, "github": { "type": "object", "properties": { "enabled": { "type": "boolean" }, "tokenEnv": { "type": "string", "minLength": 1 }, "repository": { "type": "string", "pattern": "^[^/]+/[^/]+$" }, "apiBaseUrl": { "type": "string", "format": "uri" }, "assignTokenOwner": { "type": "boolean" }, "labels": { "type": "array", "items": { "type": "string" } }, "branchPattern": { "type": "string", "minLength": 1 }, "finalizeOnAcceptance": { "type": "boolean" }, "pullRequestDraft": { "type": "boolean" } } }, "paseo": { "type": "object", "properties": { "enabled": { "type": "boolean" }, "createWorkspace": { "type": "boolean" }, "autoUseWorkspace": { "type": "boolean" }, "worktreeSlugPattern": { "type": "string", "minLength": 1 } } } } },
     "memory": { "type": "object" },
-    "codeIntelligence": { "type": "object", "properties": { "provider": { "type": "string" }, "required": { "type": "boolean" }, "graphPath": { "type": "string" }, "snapshotDir": { "type": "string" }, "refreshCommand": { "type": "string" }, "scheduling": { "type": "object", "properties": { "useEdges": { "type": "boolean" }, "maxGraphHops": { "type": "integer", "minimum": 1 }, "maxSharedNodes": { "type": "integer", "minimum": 0 }, "centralityConflictThreshold": { "type": "number", "minimum": 0 } } } } },
+    "codeIntelligence": { "type": "object", "properties": { "provider": { "type": "string" }, "required": { "type": "boolean" }, "graphPath": { "type": "string" }, "snapshotDir": { "type": "string" }, "codeOnly": { "type": "boolean" }, "refreshCommand": { "type": "string" }, "scheduling": { "type": "object", "properties": { "useEdges": { "type": "boolean" }, "maxGraphHops": { "type": "integer", "minimum": 1 }, "maxSharedNodes": { "type": "integer", "minimum": 0 }, "centralityConflictThreshold": { "type": "number", "minimum": 0 } } } } },
     "context": { "type": "object", "properties": {
       "mode": { "enum": ["observe", "enforce"] },
       "budgets": { "type": "object", "properties": {

package/schemas/validation-report.schema.json

@@ -9,7 +9,8 @@
     "taskId": { "type": "string" },
     "status": { "enum": ["PASS", "FAIL"] },
     "checks": { "type": "array" },
-    "changedFiles": { "type": "array", "items": { "type": "string" } }
+    "changedFiles": { "type": "array", "items": { "type": "string" } },
+    "findings": { "type": "array", "items": { "type": "object", "required": ["fingerprint", "tool", "kind"], "properties": { "fingerprint": { "type": "string", "pattern": "^[a-f0-9]{64}$" }, "tool": { "type": "string" }, "kind": { "type": "string" }, "rule": { "type": "string" }, "severity": { "type": "string" }, "file": { "type": "string" }, "line": { "type": "integer", "minimum": 1 }, "message": { "type": "string" }, "artifact": { "type": "string" } }, "additionalProperties": true } }
   },
   "additionalProperties": true
 }

package/scripts/headroom-bridge.py

@@ -0,0 +1,88 @@
+#!/usr/bin/env python3
+"""Small, line-oriented JSON bridge for the pinned Headroom SDK.
+
+The bridge deliberately uses Headroom's public ``headroom.compression`` API,
+never its agent wrappers or memory store.  stdout is reserved for one JSON
+response; diagnostics belong on stderr so the Node adapter can reject framing
+corruption deterministically.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import sys
+from typing import Any
+
+
+def fail(message: str, code: str = "HEADROOM_BRIDGE_ERROR") -> None:
+    print(json.dumps({"version": 1, "error": {"code": code, "message": message}}), flush=True)
+
+
+def main() -> int:
+    try:
+        raw = sys.stdin.read()
+        request = json.loads(raw)
+        if not isinstance(request, dict) or request.get("version") != 1:
+            fail("request version must be 1", "INVALID_REQUEST")
+            return 2
+        operation = request.get("operation", "compress")
+        from headroom import __version__
+
+        if operation == "doctor":
+            print(json.dumps({"version": 1, "providerVersion": __version__}), flush=True)
+            return 0
+        if operation != "compress":
+            fail(f"unsupported operation: {operation}", "INVALID_REQUEST")
+            return 2
+
+        content = request.get("content")
+        source_sha256 = request.get("sourceSha256")
+        max_tokens = request.get("maxTokens")
+        if not isinstance(content, str) or not content:
+            fail("content must be a non-empty string", "INVALID_REQUEST")
+            return 2
+        if not isinstance(source_sha256, str) or hashlib.sha256(content.encode()).hexdigest() != source_sha256:
+            fail("sourceSha256 does not match content", "SOURCE_HASH_MISMATCH")
+            return 2
+        if not isinstance(max_tokens, int) or max_tokens < 1:
+            fail("maxTokens must be a positive integer", "INVALID_REQUEST")
+            return 2
+
+        # UniversalCompressor is the documented local SDK entry point.  Keep
+        # Kompress enabled: AEH provisions headroom-ai[all] and this contract
+        # must exercise the intended compression stack, not the fallback-only
+        # path. CCR remains disabled because AEH persists and authorizes the
+        # original fragment itself.
+        from headroom.compression import UniversalCompressor, UniversalCompressorConfig
+
+        original_tokens = max(1, len(content) // 4)
+        target_ratio = min(1.0, max_tokens / original_tokens)
+        compressor = UniversalCompressor(
+            UniversalCompressorConfig(
+                use_magika=True,
+                use_kompress=True,
+                ccr_enabled=False,
+                compression_ratio_target=target_ratio,
+            )
+        )
+        result = compressor.compress(content)
+        response: dict[str, Any] = {
+            "version": 1,
+            "content": result.compressed,
+            "originalTokens": result.tokens_before,
+            "compressedTokens": result.tokens_after,
+            "reversible": False,
+            "providerVersion": __version__,
+            "sourceSha256": source_sha256,
+        }
+        print(json.dumps(response, separators=(",", ":")), flush=True)
+        return 0
+    except Exception as error:  # pragma: no cover - exercised by contract tests
+        print(f"headroom bridge failure: {error}", file=sys.stderr, flush=True)
+        fail(str(error), "SDK_RUNTIME_FAILURE")
+        return 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/templates/provider-versions.json

@@ -0,0 +1,10 @@
+{
+  "headroom": "0.28.0",
+  "graphify": "0.9.43",
+  "engram": "0.4.1",
+  "serena": "1.6.1",
+  "trivy": "0.70.0",
+  "opengrep": "1.22.0",
+  "playwright": "1.62.1",
+  "pnpm": "10.15.0"
+}

package/templates/toolchain.yaml

@@ -106,7 +106,7 @@ tools:
     kind: mise
     command: graphify
     source: "pipx:graphifyy"
-    version: latest
+    version: "0.9.43"
     dependsOn: [uv]
     activateWhen: [code-intelligence:graphify]
 
@@ -132,7 +132,8 @@ tools:
     kind: mise
     command: engram
     source: "npm:@engram-ai-memory/cli"
-    version: latest
+    version: "0.4.1"
+    dependsOn: [pnpm]
     activateWhen: [memory:engram]
 
   opa:
@@ -148,14 +149,14 @@ tools:
     kind: mise
     command: opengrep
     source: "aqua:opengrep/opengrep"
-    version: latest
+    version: "1.22.0"
     activateWhen: [security-tool:opengrep, validator:opengrep]
 
   trivy:
     kind: mise
     command: trivy
     source: "aqua:aquasecurity/trivy"
-    version: latest
+    version: "0.70.0"
     activateWhen: [security-tool:trivy, validator:trivy]
     container:
       image: ghcr.io/aquasecurity/trivy:latest
@@ -172,6 +173,13 @@ tools:
     command: podman
     activateWhen: [orchestration:podman, sandbox:podman]
 
+  pnpm:
+    kind: mise
+    command: pnpm
+    source: "npm:pnpm"
+    version: "10.15.0"
+    activateWhen: [memory:engram, project:pnpm]
+
 projectDependencies:
   autoDetect: true
   commands: []