codex-genesis-harness 0.1.8 → 0.1.9

package/.codebase/CURRENT_STATE.md

@@ -1,37 +1,11 @@
 # Current System State
 
-**Time**: 2026-06-03  
-**Status**: `COMPLETED`  
-**Latest Session**: `2026-06-03-full-score-fix`  
-**Time to First Verification (TTFV)**: 180s (KPI achieved)
+**Time**: 2026-06-12
+**Status**: `COMPLETED`
+**Latest Session**: `2026-06-12-lifecycle-pipeline-hardening`
+**Time to First Verification (TTFV)**: 180s
 
-## Architectural Position
+## Latest Transition
 
-The Genesis Codex Harness system is fully operational and has achieved a **110/110 perfect score** against the Harness Engineering criteria (L02-L12). 
-
-It now acts as the true primitive for an autonomous AI agent, enforcing constraints before, during, and after task execution.
-
-## Recent Changes (2026-06-03)
-
-- **L08 Feature Registry**: Moved features from prose (`ROADMAP.md`) into a machine-readable `features/REGISTRY.md` with schema enforcement and per-feature `verify_cmd`.
-- **L11 Observability**: Bootstrapped the `observability/` folder with live, schema-backed data (`agent-runs`, `failures`, `decision-logs`).
-- **L04 Instruction Length**: Refactored `genesis-observability-automation/SKILL.md` to split heavy content into `references/` (reduced from 383 to 148 lines).
-- **L03 Cold-Start**: Created `scripts/cold-start-check.js` to automatically verify the repo can answer the 5 core questions without external context.
-- **L09 Victory Blocker**: Added `genesis-harness verify-gate` — the agent MUST invoke this to run all tests before claiming done.
-- **L12 Debt Log**: Populated `KNOWN_PROBLEMS.md` with 8 tracked technical debt items.
-- **L05 Session Continuity**: Added `session_id`, `session_started_at`, and `ttfv_seconds` to `state.json`.
-- **L07 Scope Ledger**: Added `scripts/check-scope.sh` to enforce file boundaries via `features/SCOPE-template.md`.
-- **L02 Context Scaling**: Added `auto_scale` hints to `.codebase/context-policy.json`.
-
-## Active Context Layers
-
-1. **System of Record**: `features/REGISTRY.md` holds the truth for what is planned vs. verified.
-2. **Context Policy**: `.codebase/context-policy.json` (Token budget: 12,000, 3 layers).
-3. **Execution Gate**: `run-evals.sh` checks structure; `feature_registry.test.js` checks registry content; `check-scope.sh` checks file boundary adherence.
-
-## Next Task Ready
-
-The harness is completely hardened. The next session can now safely focus on:
-1. Publishing `codex-genesis-harness@0.1.7` to npm.
-2. Building the first downstream consumer project using this harness.
-3. Implementing the `scripts/check-scope.sh` integration natively into `prompt_sentinel.js`.
+- State changed to `COMPLETED`
+- Reason: End-to-end lifecycle pipeline verified with project closure and audit

package/.codebase/KNOWN_PROBLEMS.md

@@ -1,6 +1,6 @@
 # Known Problems
 
-Last updated: 2026-06-03
+Last updated: 2026-06-12
 
 ## Active Technical Debt
 
@@ -55,3 +55,22 @@ Last updated: 2026-06-03
 - **Mitigation**: `genesis-verification-before-completion` skill partially addresses this through mandatory evidence.
 - **Permanent Fix Needed**: Integrate a token-budget warning callback in the `prompt_sentinel.js` that flags imminent convergence.
 - **Priority**: P3
+
+### TD-009: Dependency directory was tracked in Git
+- **Symptom**: `node_modules/` contributed hundreds of tracked files even though dependencies are reproducible from `package-lock.json`.
+- **Impact**: Noisy diffs, larger clones, and a higher risk of stale or platform-specific dependency artifacts.
+- **Fix applied**: Removed `node_modules/` from the Git index, added it to `.gitignore`, and added `scripts/check-repository-hygiene.js` to the structural verification path.
+- **Status**: RESOLVED
+
+### TD-010: Historical unpacked package artifact remains tracked
+- **Symptom**: `tmp_pack/` keeps a full historical package tree in Git.
+- **Impact**: Repository duplication remains higher than necessary.
+- **Mitigation**: Explicitly allowlisted for now because current repository state identifies it as historical evidence.
+- **Permanent Fix Needed**: Replace it with a compact expected tarball manifest after confirming no release or regression workflow consumes the unpacked tree.
+- **Priority**: P2
+
+### TD-011: Feature completion previously lacked project closure
+- **Symptom**: A verified active feature could be presented as lifecycle completion without proving all queued work or producing a release-ready handoff.
+- **Impact**: Projects could stop between feature execution and acceptance with no deterministic next action.
+- **Fix applied**: Added queue promotion, `verify-project`, `RELEASE_READY`, `complete-project`, append-only event history, and `pipeline-audit`.
+- **Status**: RESOLVED

package/.codebase/MODULE_INDEX.md

@@ -1,7 +1,12 @@
 # Module Index
 
 - `.codex/skills/`: packaged Codex skills.
-- `bin/genesis-harness.js`: npm CLI for install, verify, uninstall, and path output.
+- `bin/genesis-harness.js`: npm CLI for install, verify, uninstall, docs gates, idea bootstrap, resumable execution, multi-feature queue routing, feature/project verification, release-ready completion, and pipeline audit.
+- `scripts/check-repository-hygiene.js`: blocks tracked dependency and generated artifacts such as `node_modules/`, `dist/`, and package tarballs.
+- `contracts/features/project-registry-schema.json`: contract for generated `.planning/FEATURE_REGISTRY.json` lifecycle queues.
+- `.github/workflows/reusable-verify.yml`: reusable GitHub Actions workflow that runs the canonical `genesis-harness verify-gate` path and uploads verification artifacts.
+- `.github/workflows/docs-sync.yml`: CI entrypoint that delegates pull-request and protected-branch verification to the reusable verify workflow.
+- `.github/workflows/publish-npm.yml`: release-oriented npm publishing workflow using GitHub OIDC trusted publishing and provenance.
 - `scripts/verify.sh`: structural and smoke verification.
 - `scripts/run-evals.sh`: package-level regression checks.
 - `.codebase/`: compressed repository memory.
@@ -13,9 +18,17 @@
 - `fixtures/`: reusable test and validation fixtures.
 - `tests/`: harness test architecture templates.
 - `tests/unit/feature_registry.test.js`: validates feature registry schema and observability live data (L08 + L11).
+- `tests/unit/workflow_contracts.test.js`: validates that GitHub workflows use the reusable verify path and trusted npm publishing defaults.
 - `playwright/`: UI smoke, e2e, and visual harness templates.
 - `observability/`: autonomous run and decision logging templates.
 - `observability/agent-runs/`: per-session agent execution records (L11).
 - `observability/decision-logs/`: rationale logs for significant decisions (L11).
 - `observability/failures/`: failure records with root-cause and prevention notes (L11).
-
+- `.codex/skills/genesis-harness/scripts/init-planning.sh`: planning bootstrap that now creates Foundation + Discovery/QA scaffolds.
+- `.planning/INIT_QA.md`: initialization questionnaire for product approach, QA closure, and tech stack sign-off.
+- `.codebase/PHASE_DEPENDENCY_MAP.md`: init-created dependency map used by spec-impact-engine and downstream planning.
+- `.codebase/state.json`: canonical runtime state for the harness repo and generated projects; `run --idea` now advances project state into `IMPLEMENTATION` with `active_feature`, and `resume` restores the next actionable task from it.
+- `.runs/`: per-session run artifacts (`INPUT.md`, `DISCOVERY.json`, `STATE.json`, `RESUME.md`, `EVENTS.jsonl`) used for resume and append-only lifecycle history.
+- `.planning/FEATURE_REGISTRY.json`: generated project-level execution queue consumed by `add-feature`, `next`, `complete-feature`, `verify-project`, `complete-project`, and `pipeline-audit`.
+- `.planning/PROJECT_VERIFICATION.json`: project-wide feature proof and acceptance proof record.
+- `.planning/IMPLEMENTATION_HANDOFF.md`: release-ready handoff generated only after all proofs pass.

package/.codebase/PIPELINE_FLOW.md

@@ -8,8 +8,16 @@ flowchart LR
   test --> fixture["Create fixture and expected output"]
   fixture --> contracts["Update contracts when behavior changes"]
   contracts --> impl["Implement minimum change"]
-  impl --> verify["Run verification"]
-  verify --> memory["Update .codebase memory"]
+  impl --> featureVerify["Run feature proof"]
+  featureVerify --> featureComplete["complete-feature records evidence"]
+  featureComplete --> queued{"Queued feature remains?"}
+  queued -->|yes| impl
+  queued -->|no| projectVerify["verify-project reruns all feature proofs and project proof"]
+  projectVerify --> handoff["Write project verification and implementation handoff"]
+  handoff --> releaseReady["RELEASE_READY"]
+  releaseReady --> projectComplete["complete-project records release or acceptance evidence"]
+  projectComplete --> audit["pipeline-audit checks state, proofs, handoff, and event history"]
+  audit --> memory["Update .codebase memory and metrics"]
   memory --> docs["Update docs"]
   docs --> sync["Run genesis-harness sync"]
   sync --> summary["Write change summary"]

package/.codebase/RECOVERY_POINTS.md

@@ -4,6 +4,69 @@ A reverse-chronological log of stable states to return to if the current task co
 
 ---
 
+## 2026-06-12: End-to-End Project Lifecycle
+- **Status**: Stable
+- **Git State**: Multi-feature orchestration, project verification, release-ready handoff, append-only events, and lifecycle audit are implemented and covered by integration tests.
+- **Why it's stable**: `cli-smoke.test.js` exercises idea bootstrap through two feature completions, project proof, final completion, idempotency, event history, and audit; the canonical `verify-gate` passes and is now the single completion gate.
+- **How to recover**: Use `.runs/<session-id>/STATE.json`, `RESUME.md`, and `EVENTS.jsonl`; run `pipeline-audit` before resuming the command reported by `next`.
+- **Files changed**: CLI, lifecycle state machine, project registry contract, pipeline fixtures/tests, orchestration skill, plugin prompt, README files, and repository memory.
+
+## 2026-06-12T16:50:17+07:00: Lifecycle Pipeline + Repository Hygiene
+- **Status**: Stable
+- **Git State**: Lifecycle and hygiene changes verified locally; tracked `node_modules/` entries are staged for removal while local installed dependencies remain available.
+- **Why it's stable**: `run --idea` creates a project feature registry, `next` resolves executable work, and `complete-feature` requires a passing command plus explicit evidence before closing state. Repository verification blocks tracked dependencies and generated package artifacts, while tarball smoke tests reject generated `scripts/bin/` binaries.
+- **How to recover**: Reapply this checkpoint if `.planning/FEATURE_REGISTRY.json` stops being generated, completion bypasses verification, evidence or metrics disappear, or `node_modules/` becomes tracked again.
+- **Files changed**: `bin/genesis-harness.js`, `scripts/check-repository-hygiene.js`, `scripts/verify.sh`, `scripts/run-evals.sh`, lifecycle contracts/fixtures/tests, README files, and `.codebase/*`.
+
+## 2026-06-10T10:05:00Z: Feature Execution Bootstrap
+- **Status**: Stable
+- **Git State**: Working tree verified after `run`/`resume` orchestration started auto-scaffolding the first execution-ready feature.
+- **Why it's stable**: `tests/integration/cli-smoke.test.js`, `scripts/verify.sh`, `scripts/run-evals.sh`, and `genesis-harness verify-gate` now cover the handoff from discovery into `IMPLEMENTATION` with `active_feature` persisted in `.runs/`.
+- **How to recover**: Reapply from this point if `run --idea` falls back to `PLANNING`, if `.planning/features/<NNN>-...` stops being created automatically, or if `resume` loses the active feature checkpoint.
+- **Files changed**: `bin/genesis-harness.js`, `tests/integration/cli-smoke.test.js`, `fixtures/pipeline/run-to-feature-execution-fixture.md`, and `.codebase/*.md`.
+
+## 2026-06-10T10:25:00Z: Typed First-Slice Contract Bootstrap
+- **Status**: Stable
+- **Git State**: Working tree verified after the first feature scaffold started emitting API/UI-specific contracts and fixtures.
+- **Why it's stable**: `run --idea` now creates `contracts/ui`, `contracts/api`, `playwright/fixtures`, and `fixtures/api` artifacts when the discovery answers imply those surfaces, and `tests/integration/cli-smoke.test.js` locks the generated paths and tailored values.
+- **How to recover**: Reapply from this point if the first feature loses typed contract scaffolding, if generated routes/endpoints regress to generic placeholders, or if `TEST_CONTRACT.md` stops referencing the generated contract paths.
+- **Files changed**: `bin/genesis-harness.js`, `tests/integration/cli-smoke.test.js`, `fixtures/pipeline/run-to-feature-execution-fixture.md`, `tests/fixtures/fixture-index.md`, and `.codebase/*.md`.
+
+## 2026-06-10T08:34:56Z: Workflow Consolidation + Trusted Publish Hardening
+- **Status**: Stable
+- **Git State**: Working tree verified after CI workflow consolidation, registry cleanup, and release-path hardening.
+- **Why it's stable**: GitHub Actions now reuse a single `verify-gate` path, release publishing expects OIDC trusted publishing with provenance, and workflow contract tests block drift back to placeholder CI logic.
+- **How to recover**: Reapply from this point if CI starts bypassing `verify-gate`, if docs-sync regains custom placeholder logic, or if npm publishing falls back to long-lived tokens and mutable CI version rewrites.
+- **Files changed**: `.github/workflows/*.yml`, `tests/unit/workflow_contracts.test.js`, `features/REGISTRY.md`, and `.codebase/*.md`.
+
+## 2026-06-10T16:45:00+07:00: Resume + Run Artifact Hardening
+- **Status**: Stable
+- **Git State**: Working tree verified after resumable run-artifact and state-invariant changes.
+- **Why it's stable**: `run` now writes per-session `.runs/<session-id>` artifacts, `resume` can backfill and report from them, and state metadata tests block stale timestamps.
+- **How to recover**: Reapply from this point if mid-project resume loses the next task, if `.runs/` stops being populated, or if `completed_at` drifts behind the active session.
+- **Files changed**: `bin/genesis-harness.js`, `.codebase/state.json`, `.codebase/*.md`, `scripts/run-evals.sh`, and CLI/unit test coverage.
+
+## 2026-06-10T14:20:00+07:00: Auto-init + Discovery Bootstrap
+- **Status**: Stable
+- **Git State**: Working tree verified after init bootstrap changes.
+- **Why it's stable**: `tests/integration/cli-smoke.test.js`, `scripts/verify.sh`, `scripts/run-evals.sh` (with temporary npm cache override), and `npm run pack:check` pass.
+- **How to recover**: Reapply from this point if init stops creating `.planning/INIT_QA.md`, `01-discovery-and-qa`, or `.codebase/PHASE_DEPENDENCY_MAP.md`.
+- **Files changed**: `bin/genesis-harness.js`, `init-planning.sh`, `genesis-harness` skill routing docs, and init smoke coverage.
+
+## 2026-06-10T14:55:00+07:00: Idea-Seeded Planner Bootstrap
+- **Status**: Stable
+- **Git State**: Working tree verified after brief-to-planning bootstrap changes.
+- **Why it's stable**: `init --idea "<brief>"` now fills planning docs and planner state, and verification still passes on `cli-smoke`, `verify.sh`, `run-evals.sh`, and `pack:check`.
+- **How to recover**: Reapply from this point if user brief content stops propagating into `PROJECT.md`, `REQUIREMENTS.md`, `STACK.md`, `SUMMARY.md`, or `.codebase/state.json`.
+- **Files changed**: `bin/genesis-harness.js`, `init-planning.sh`, `genesis-harness` prompt/routing docs, and init smoke coverage.
+
+## 2026-06-10T15:05:00+07:00: Runtime Pipeline + Verification Hardening
+- **Status**: Stable
+- **Git State**: Working tree verified after runtime pipeline, gate hardening, and metadata drift fixes.
+- **Why it's stable**: `genesis-harness run --idea ... --yes` now advances a blank repo into planning with persisted discovery answers, and `verify-gate` now matches the required completion contract.
+- **How to recover**: Reapply from this point if `run` stops filling planning docs, if `verify-gate` stops executing evals/docs/pack checks, or if plugin/package/state metadata drift returns.
+- **Files changed**: `bin/genesis-harness.js`, `init-planning.sh`, `.codex-plugin/plugin.json`, `.codebase/*.md`, `.codebase/state.json`, `scripts/run-evals.sh`, and CLI/unit/integration tests.
+
 ## 2026-06-03T09:55:00+07:00: Full Score Harness Fix (110/110)
 - **Status**: Stable
 - **Git State**: Everything committed + new features added.

package/.codebase/TEST_MATRIX.md

@@ -4,8 +4,12 @@ Required checks:
 
 - `scripts/verify.sh`: repository harness structure, skill metadata, contracts, fixtures, harness smoke test, and `SKILL.md` progressive-disclosure line limit.
 - `scripts/run-evals.sh`: install/verify/uninstall regression checks, manifest route checks, sync-generated Mermaid relationship checks, hook docs-gate checks, LeanCTX policy checks, handoff/state freshness checks, `tests/unit/*.test.js`, and `tests/integration/*.test.js`.
-- `tests/integration/cli-smoke.test.js`: package CLI smoke for install/postinstall LeanCTX seeding, `path`, `status`, `docs`, `docs-gate`, `leanctx`, `prime`, and `sync` in temporary fixture repositories.
+- `tests/integration/cli-smoke.test.js`: package CLI smoke for install/postinstall LeanCTX seeding, deterministic idea bootstrap, resumable run artifacts, multi-feature queue promotion, evidence-gated feature completion, project-wide verification, release-ready handoff, idempotent project completion, append-only events, lifecycle audit, metrics, and observability output.
+- `tests/unit/repository_hygiene.test.js`: prevents tracked dependency or generated artifacts from returning.
 - `tests/unit/prompt_sentinel.test.js`: LeanCTX-backed prompt sentinel threshold and truncation behavior.
+- `tests/unit/state_metadata.test.js`: keeps `.codebase/CURRENT_STATE.md` and `.codebase/state.json` aligned for session, TTFV, legal state enums, and non-stale completion timestamps.
+- `tests/unit/verify_gate.test.js`: verifies that `verify-gate` includes evals, docs-gate, pack dry-run, and LeanCTX checks.
+- `tests/unit/workflow_contracts.test.js`: verifies CI workflows delegate to the reusable `verify-gate` path, pin critical actions, and use trusted npm publishing with provenance.
 - `npm run pack:check`: package contents dry-run.
 - Skill validation: run `quick_validate.py` for changed skills when available.
 

package/.codebase/memories/lessons_learned.md

@@ -19,3 +19,45 @@ This file chronicles the major failures, recursive bugs, and architectural dead-
 - **Root Cause**: Using `cat` on large files or `ls -R` without filters.
 - **Resolution**: 
 - **Rule**: Always use the native `view_file`, `list_dir`, and `grep_search` tools with precise line bounds or search terms. NEVER `cat` a file directly in bash if a native agent tool exists.
+
+## 4. Init Must Not Depend On Explicit Slash Commands
+- **Symptom**: The harness stayed idle on a blank repo until the user typed `/init`, even when the user had already provided a product idea.
+- **Root Cause**: The entry skill documented `/init`, but the actual CLI/bootstrap path only exposed an explicit interactive command and did not scaffold discovery artifacts automatically.
+- **Resolution**: Treat "empty repo + user idea" as implicit init in `genesis-harness` docs, and make CLI `init` call `init-planning.sh` to create Foundation, Discovery/QA, and dependency-map artifacts.
+- **Rule**: For cold starts, initialize first, then ask the discovery/QA/tech-stack questions. Do not force the user to know the harness command vocabulary.
+
+## 5. Auto-init Must Preserve The User Brief
+- **Symptom**: Even after auto-init started running, the planner still dumped mostly `TBD` placeholders and lost the original idea unless the user repeated it.
+- **Root Cause**: Initialization created structure but did not treat the first user brief as durable bootstrap input.
+- **Resolution**: `genesis-harness init --idea "<brief>"` now seeds planning docs and planner state from the brief before follow-up QA begins.
+- **Rule**: The first user idea is a source artifact. Persist it into planning docs and state immediately, then ask only the missing clarification questions.
+
+## 6. Prompt Contracts Must Match Runtime Contracts
+- **Symptom**: Skill docs and plugin prompts said the harness could auto-init from an idea, but the executable runtime still depended on manual follow-up and incomplete verification gates.
+- **Root Cause**: Routing docs, plugin metadata, and gate definitions evolved separately from the actual CLI control flow.
+- **Resolution**: Add a deterministic `genesis-harness run --idea ... --yes` pipeline, make `verify-gate` execute the full completion bar, and add regression tests for both.
+- **Rule**: Do not describe a harness behavior in prompts or memory until there is a CLI/runtime path and a regression test that enforces it.
+
+## 7. Resume Requires Durable Session Artifacts, Not Just State Labels
+- **Symptom**: The harness could move into planning, but a later session still had to infer what to do next from scattered markdown because there was no canonical run checkpoint.
+- **Root Cause**: `.codebase/state.json` carried phase labels, but there was no per-session artifact bundle tying brief, discovery answers, and next tasks together.
+- **Resolution**: `run` now writes `.runs/<session-id>/INPUT.md`, `DISCOVERY.json`, `STATE.json`, and `RESUME.md`, and `resume` reads or backfills them from state.
+- **Rule**: Any harness phase that claims resumability must emit a durable per-session artifact bundle and a deterministic resume entrypoint.
+
+## 8. Discovery-Only Pipelines Still Break End-To-End Execution
+- **Symptom**: `run --idea` looked complete in docs, but it only stopped at "Create the first feature plan", forcing a human or later session to bridge the actual execution gap manually.
+- **Root Cause**: Discovery persistence existed, but there was no runtime handoff that turned approved scope into a concrete active feature scaffold.
+- **Resolution**: `run` now creates the first feature scaffold automatically, seeds spec/plan/test-contract/verification files, records `active_feature`, and advances resumable state into `IMPLEMENTATION`.
+- **Rule**: A harness pipeline is not end-to-end unless it leaves the next session inside an execution-ready slice with explicit tests, contracts, and verification steps already scaffolded.
+
+## 9. Generic Execution Scaffolds Still Leave Contract Work To Humans
+- **Symptom**: Even after execution bootstrap existed, the first feature slice still began with only generic planning files, so the next agent had to invent API/UI contracts and fixtures manually.
+- **Root Cause**: The runtime scaffold did not classify the first slice by surface area and did not reuse the repository's contract and fixture structure.
+- **Resolution**: The bootstrap now infers `ui`, `api`, or `full-stack` from discovery answers and emits typed artifacts in `contracts/ui/<feature>/`, `contracts/api/<feature>/`, `playwright/fixtures/`, and `fixtures/api/`.
+- **Rule**: If a harness claims contract-first execution, the first slice must already contain the concrete contract and fixture paths needed by the likely implementation surface.
+
+## 10. Feature Completion Is Not Project Completion
+- **Symptom**: The runtime could verify one active feature, but there was no repeatable queue promotion, project-wide proof rerun, release-ready handoff, or drift audit before marking the project done.
+- **Root Cause**: Feature lifecycle state and project lifecycle state were treated as the same boundary.
+- **Resolution**: Added a multi-feature registry, append-only lifecycle events, project-wide verification, a distinct `RELEASE_READY` state, evidence-gated project completion, and `pipeline-audit`.
+- **Rule**: A project may reach `COMPLETED` only after every feature is verified, all proof commands pass again at project scope, the handoff exists, and release or acceptance evidence is recorded.

package/.codebase/state.json

@@ -1,13 +1,12 @@
 {
   "current_state": "COMPLETED",
-  "completed_at": "2026-06-03T02:42:00Z",
-  "active_work": "Full Score Harness Fix — L02-L12",
-  "session_id": "2026-06-03-full-score-fix",
-  "session_started_at": "2026-06-03T02:35:00Z",
+  "active_work": "",
+  "session_id": "2026-06-12-lifecycle-pipeline-hardening",
+  "session_started_at": "2026-06-12T16:47:17+07:00",
   "ttfv_seconds": 180,
-  "_comment_ttfv": "Time-to-First-Verification: seconds from session start to first passing test (L06 KPI). 180s = 3min for this session.",
+  "_comment_ttfv": "Time-to-First-Verification: 180s from session start to first passing targeted lifecycle test.",
   "latest_handoff": ".codebase/IMPLEMENTATION_HANDOFF.md",
-  "latest_recovery_point": "Full Score Harness Fix — feature registry + observability",
+  "latest_recovery_point": "End-to-end lifecycle pipeline verified with project closure and audit",
   "required_verification": [
     "npm run verify",
     "npm run eval",
@@ -15,9 +14,43 @@
     "node tests/unit/feature_registry.test.js",
     "node scripts/cold-start-check.js",
     "node bin/genesis-harness.js docs-gate",
-    "node bin/genesis-harness.js leanctx"
+    "node bin/genesis-harness.js leanctx",
+    "node tests/unit/verify_gate.test.js",
+    "node tests/unit/workflow_contracts.test.js",
+    "node tests/integration/cli-smoke.test.js",
+    "node tests/unit/state_metadata.test.js",
+    "node tests/unit/repository_hygiene.test.js",
+    "node bin/genesis-harness.js verify-gate"
   ],
   "history": [
+    {
+      "from": "IMPLEMENTATION",
+      "to": "COMPLETED",
+      "reason": "Added project feature registry routing, evidence-gated feature completion, lifecycle metrics, observability output, and repository hygiene enforcement.",
+      "timestamp": "2026-06-12T16:50:17+07:00",
+      "session_id": "2026-06-12-lifecycle-pipeline-hardening"
+    },
+    {
+      "from": "COMPLETED",
+      "to": "COMPLETED",
+      "reason": "Prepared README and changelog notes for the v0.1.9 release and verified package contents.",
+      "timestamp": "2026-06-11T10:25:00+07:00",
+      "session_id": "2026-06-11-release-readme-prep"
+    },
+    {
+      "from": "IMPLEMENTATION",
+      "to": "COMPLETED",
+      "reason": "Runtime pipeline now emits API/UI-specific contracts and fixtures for the first scaffolded feature slice.",
+      "timestamp": "2026-06-10T10:25:00Z",
+      "session_id": "2026-06-10-typed-first-slice-bootstrap"
+    },
+    {
+      "from": "IMPLEMENTATION",
+      "to": "COMPLETED",
+      "reason": "Runtime pipeline now auto-scaffolds the first execution-ready feature and persists the active feature checkpoint for resume.",
+      "timestamp": "2026-06-10T10:05:00Z",
+      "session_id": "2026-06-10-feature-execution-bootstrap"
+    },
     {
       "from": "VERIFICATION",
       "to": "COMPLETED",
@@ -41,18 +74,103 @@
     },
     {
       "from": "COMPLETED",
-      "to": "EXECUTE",
+      "to": "IMPLEMENTATION",
       "reason": "Started full harness evaluation and score fix: L08 feature registry, L11 observability live, L04 instruction size, L03 cold-start, L05 session boundary, L07 scope, L09 victory blocker, L12 known problems.",
       "timestamp": "2026-06-03T02:35:00Z",
       "session_id": "2026-06-03-full-score-fix"
+    },
+    {
+      "from": "COMPLETED",
+      "to": "IMPLEMENTATION",
+      "reason": "Implement end-to-end multi-feature project lifecycle",
+      "timestamp": "2026-06-12T10:03:52.067Z",
+      "session_id": "2026-06-12-lifecycle-pipeline-hardening"
+    },
+    {
+      "from": "IMPLEMENTATION",
+      "to": "VERIFICATION",
+      "reason": "Run full lifecycle and repository verification",
+      "timestamp": "2026-06-12T10:03:52.118Z",
+      "session_id": "2026-06-12-lifecycle-pipeline-hardening"
+    },
+    {
+      "from": "VERIFICATION",
+      "to": "IMPLEMENTATION",
+      "reason": "Refresh lifecycle metadata after transition script fix",
+      "timestamp": "2026-06-12T10:04:41.327Z",
+      "session_id": "2026-06-12-lifecycle-pipeline-hardening"
+    },
+    {
+      "from": "IMPLEMENTATION",
+      "to": "VERIFICATION",
+      "reason": "Run full lifecycle and repository verification",
+      "timestamp": "2026-06-12T10:04:41.409Z",
+      "session_id": "2026-06-12-lifecycle-pipeline-hardening"
+    },
+    {
+      "from": "VERIFICATION",
+      "to": "IMPLEMENTATION",
+      "reason": "Refresh current-state metadata contract",
+      "timestamp": "2026-06-12T10:05:21.693Z",
+      "session_id": "2026-06-12-lifecycle-pipeline-hardening"
+    },
+    {
+      "from": "IMPLEMENTATION",
+      "to": "VERIFICATION",
+      "reason": "Run full lifecycle and repository verification",
+      "timestamp": "2026-06-12T10:05:21.810Z",
+      "session_id": "2026-06-12-lifecycle-pipeline-hardening"
+    },
+    {
+      "from": "VERIFICATION",
+      "to": "RELEASE_READY",
+      "reason": "All feature and project verification gates passed",
+      "timestamp": "2026-06-12T10:05:54.545Z",
+      "session_id": "2026-06-12-lifecycle-pipeline-hardening"
+    },
+    {
+      "from": "RELEASE_READY",
+      "to": "COMPLETED",
+      "reason": "End-to-end lifecycle pipeline verified with project closure and audit",
+      "timestamp": "2026-06-12T10:06:47.807Z",
+      "session_id": "2026-06-12-lifecycle-pipeline-hardening"
+    },
+    {
+      "from": "COMPLETED",
+      "to": "IMPLEMENTATION",
+      "reason": "Refresh completed-state metadata behavior",
+      "timestamp": "2026-06-12T10:07:09.243Z",
+      "session_id": "2026-06-12-lifecycle-pipeline-hardening"
+    },
+    {
+      "from": "IMPLEMENTATION",
+      "to": "VERIFICATION",
+      "reason": "Final verification after state writer hardening",
+      "timestamp": "2026-06-12T10:07:09.342Z",
+      "session_id": "2026-06-12-lifecycle-pipeline-hardening"
+    },
+    {
+      "from": "VERIFICATION",
+      "to": "RELEASE_READY",
+      "reason": "Canonical verify-gate passed for end-to-end lifecycle",
+      "timestamp": "2026-06-12T10:07:09.466Z",
+      "session_id": "2026-06-12-lifecycle-pipeline-hardening"
+    },
+    {
+      "from": "RELEASE_READY",
+      "to": "COMPLETED",
+      "reason": "End-to-end lifecycle pipeline verified with project closure and audit",
+      "timestamp": "2026-06-12T10:07:37.415Z",
+      "session_id": "2026-06-12-lifecycle-pipeline-hardening"
     }
   ],
   "context": {
-    "score_target": "110/110",
-    "package_version": "0.1.7",
+    "package_version": "0.1.9",
     "verification_owner": "scripts/run-evals.sh",
     "context_policy": ".codebase/context-policy.json",
     "evaluation_report": ".codebase/../artifacts/harness_evaluation_report.md"
   },
-  "pending_tasks": []
-}
+  "pending_tasks": [],
+  "last_updated_at": "2026-06-12T10:07:37.415Z",
+  "completed_at": "2026-06-12T10:07:37.415Z"
+}

package/.codex/skills/genesis-harness/SKILL.md

@@ -17,6 +17,12 @@ Operate a repository through a test-first, contract-first, memory-backed Codex h
 - `/spec-change`, `/propagate-spec`, `/validate-specs`
 - Any multi-step task that changes code, contracts, fixtures, tests, docs, or `.codebase`.
 
+## Auto-init trigger
+- If the repository has no `.planning/` yet and the user provides a product idea, feature idea, or project brief, treat that as an implicit `/init`.
+- Do not wait for the literal word `/init`.
+- Create the planning harness first, seed `PROJECT.md`, `REQUIREMENTS.md`, `STACK.md`, `SUMMARY.md`, and `INIT_QA.md` from the user brief when possible, then immediately move into discovery Q&A for product direction, QA closure, and tech stack sign-off.
+- When a deterministic bootstrap is needed, call `genesis-harness run --yes --platform codex --idea "<user brief>"` and pass discovery answers if they are already known.
+
 ## When NOT to use
 - Simple read-only answers with no repository workflow.
 - Tasks that are fully handled by a narrower skill and do not need planning, state, or verification artifacts.
@@ -77,6 +83,7 @@ Operate a repository through a test-first, contract-first, memory-backed Codex h
 ```txt
 /genesis-init
 /init
+/run <idea>
 /new-feature <description>
 /fix-bug <description>
 /plan <description>
@@ -104,4 +111,6 @@ Operate a repository through a test-first, contract-first, memory-backed Codex h
 - `scripts/check-docs-sync.sh`, `scripts/check-spec-changelog.sh`, `scripts/check-required-planning-files.sh`: mechanical validation.
 
 ## Initialization rule
-`/genesis-init` and `/init` create Phase 0 Foundation only. Feature phases start later after requirements are confirmed and prioritized.
+`/genesis-init` and `/init` create Phase 0 Foundation plus Phase 1 Discovery & QA. Feature phases start only after discovery answers, QA closure, and tech stack sign-off are recorded.
+
+`genesis-harness run --yes --platform codex --idea "<brief>" ...` is the deterministic CLI path when the caller wants bootstrap plus persisted discovery answers in one execution.

package/.codex/skills/genesis-harness/agents/openai.yaml

@@ -2,8 +2,7 @@ interface:
   display_name: "Genesis Harness"
   short_description: "— Lập kế hoạch, giám sát và kiểm thử dự án"
   brand_color: "#2563EB"
-  default_prompt: "Use $genesis-harness to initialize planning and operate this repository with test-first workflows."
+  default_prompt: "Use $genesis-harness to initialize planning and operate this repository with test-first workflows. If the repo is blank and the user gives only an idea, treat that as implicit init, seed planning docs from the brief, then use the deterministic run pipeline to persist discovery QA and tech stack decisions."
 
 policy:
   allow_implicit_invocation: true
-

package/.codex/skills/genesis-harness/references/state-machine.md

@@ -16,19 +16,22 @@ The Genesis Harness operates in the following strict states:
 3. `PLANNING`: Creating `implementation_plan.md` and writing tests.
 4. `IMPLEMENTATION`: Writing code to satisfy tests and plan.
 5. `VERIFICATION`: Running test scripts (`verify.sh`) and validating constraints.
-6. `COMPLETED`: All tests pass, docs are updated, ready for the next task.
+6. `RELEASE_READY`: Every feature proof and the project proof passed; the final handoff exists.
+7. `COMPLETED`: Release or acceptance evidence has been recorded after `RELEASE_READY`.
 
 ## Rules of State Transition
 
 - **NEVER** skip a state directly (e.g., from `REQUIREMENTS_GATHERING` to `IMPLEMENTATION` without `PLANNING`).
 - **ALWAYS** use the strict transition script to change states: `bash scripts/transition_state.sh <NEW_STATE> "Reason for transition"`
 - **ALWAYS** read `.codebase/state.json` when you start a new conversation or wake up, to know exactly where you left off.
+- **NEVER** transition directly from `VERIFICATION` to `COMPLETED`; project-wide verification must produce `RELEASE_READY` first.
 
 ## Handling Interruptions
 If the user's connection drops or you are restarted:
 1. Read `.codebase/state.json`
 2. If `current_state` is `IMPLEMENTATION`, resume coding based on the `task.md`.
 3. If `current_state` is `VERIFICATION`, resume running test scripts.
+4. If `current_state` is `RELEASE_READY`, inspect the implementation handoff and record release or acceptance evidence before completion.
 
 ## The State File
 The state is persisted in `.codebase/state.json`. **Do not edit this file manually.** Always use the `transition_state.sh` script to ensure validation gates are respected.

package/.codex/skills/genesis-harness/references/workflows.md

@@ -14,6 +14,13 @@ Use this file when the requested work is a feature, bug fix, plan, audit, review
 | Review changed files | `/review` |
 | Summarize current state | `/status` |
 
+## Empty Repository Rule
+
+- If the repo does not contain `.planning/` and the user starts with an idea, brief, or requested product direction, run the initialization workflow automatically.
+- Initialization is not blocked on the user typing `/init`.
+- Immediately after initialization, seed the planning docs from the brief, then request discovery answers that close product approach, QA acceptance criteria, and tech stack.
+- Prefer the deterministic bootstrap path: `genesis-harness run --yes --platform codex --idea "<user brief>"`.
+
 ## Readiness Gate
 
 - [ ] Intent is confirmed.
@@ -30,4 +37,3 @@ Use this file when the requested work is a feature, bug fix, plan, audit, review
 - [ ] Tracking files were updated.
 - [ ] Changed files were reviewed.
 - [ ] Unnecessary files, debug logs, and unrelated changes were removed.
-