create-cmp-cli 0.22.0 → 0.23.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-cmp-cli",
-  "version": "0.22.0",
+  "version": "0.23.0",
   "description": "Create production mobile apps (Android + iOS, one Kotlin codebase) with AI — the delivery harness for Compose Multiplatform, the current generation of cross-platform (Google-backed KMP, iOS stable since May 2025). A deterministic, non-interactive generator that scaffolds a green-building app in minutes, then holds AI-driven changes to a machine-enforced verify lane with a committed evidence receipt. Every app carries a device-free UI preview loop (real screens rendered headlessly on save; changed-screen attribution and compile-error surfacing for coding agents, a live gallery for humans) plus agent-first docs (CLAUDE.md + AGENTS.md). Installs the `create-cmp` command.",
   "type": "module",
   "bin": {

package/packages/harness/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@create-cmp/harness",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "description": "The create-cmp verify lane — the machine-owned harness code every stamped app carries byte-identical: evidence receipts, spec coverage, approvals, conformance reporting, golden trees, a11y, and the preview/inspector libs. Dependency-free ESM, vendored into each generated project so the lane runs offline with no install step, and content-hashed so a receipt can name the exact lane that issued it.",
   "type": "module",
   "main": "src/verify.mjs",

package/packages/harness/src/lib/harness-region.mjs

@@ -53,17 +53,58 @@ import path from "node:path";
  */
 export const HARNESS_DIRS = ["qa", "qa/lib"];
 
+/**
+ * The lane's OWN tests, when a project carries them (payment-blueprint's
+ * qa/test/**, 2026-09-03). Every `.mjs` under it, recursively, is in the
+ * region: the tests that prove the gates are locked WITH the gates, or the
+ * lane can no longer tell you that the suite vouching for its verdicts is the
+ * one it was locked with — a narrower claim in the same words, which is the
+ * failure this mechanism exists to prevent. A Compose app has no qa/test and
+ * its region (and lock) is unchanged.
+ */
+export const HARNESS_TEST_DIR = "qa/test";
+
+/**
+ * DECLARATIONS the lane READS to decide what it attests — locked for the same
+ * reason verify.mjs is. payment-blueprint's planted proof (2026-09-03): remove
+ * one entry from qa/verified-surface.json and 203 files — the whole backend —
+ * stop being attested; the next lane run mints a fresh receipt over the smaller
+ * surface, harnessIntegrity PASS, nothing in the chain says the coverage moved.
+ * An edited checker and an edited definition of what the checker looks at are
+ * the same attack. State a lane WRITES (approvals.json, comments.json, the
+ * journal, evidence/) stays out — that is the EXCLUDED_PREFIXES distinction.
+ * Neither file exists in a Compose app by default; its region is unchanged.
+ */
+export const HARNESS_DECLARATIONS = ["qa/verified-surface.json", "qa/harness-manifest.json"];
+
 /**
  * Is this project-relative path part of the machine-owned harness region?
  * @param {string} relPath project-relative path, "/"-separated
  * @returns {boolean}
  */
 export function isHarnessFile(relPath) {
-  if (typeof relPath !== "string" || !relPath.endsWith(".mjs")) return false;
+  if (typeof relPath !== "string") return false;
+  if (HARNESS_DECLARATIONS.includes(relPath)) return true;
+  if (!relPath.endsWith(".mjs")) return false;
+  if (relPath.startsWith(`${HARNESS_TEST_DIR}/`)) return true;
   const dir = relPath.includes("/") ? relPath.slice(0, relPath.lastIndexOf("/")) : "";
   return HARNESS_DIRS.includes(dir);
 }
 
+function walkMjs(dirAbs, relPrefix, out) {
+  let entries;
+  try {
+    entries = fs.readdirSync(dirAbs, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const ent of entries) {
+    const rel = `${relPrefix}/${ent.name}`;
+    if (ent.isDirectory()) walkMjs(path.join(dirAbs, ent.name), rel, out);
+    else if (ent.isFile() && isHarnessFile(rel)) out.push(rel);
+  }
+}
+
 /**
  * Every machine-owned file present under `root`, as project-relative posix
  * paths, sorted — so the list (and any hash over it) is deterministic.
@@ -85,7 +126,14 @@ export function listHarnessFiles(root) {
       if (isHarnessFile(rel)) found.push(rel);
     }
   }
-  return found.sort();
+  walkMjs(path.join(root, HARNESS_TEST_DIR), HARNESS_TEST_DIR, found);
+  // A declaration directly under qa/ is already seen by the scan above (it is
+  // a harness file by name); the explicit loop covers one that lives deeper.
+  // Deduplicated so no path is hashed twice.
+  for (const rel of HARNESS_DECLARATIONS) {
+    if (fs.existsSync(path.join(root, ...rel.split("/")))) found.push(rel);
+  }
+  return [...new Set(found)].sort();
 }
 
 /** sha256 of one file's bytes, hex. */

package/template/qa/lib/harness-region.mjs

@@ -53,17 +53,58 @@ import path from "node:path";
  */
 export const HARNESS_DIRS = ["qa", "qa/lib"];
 
+/**
+ * The lane's OWN tests, when a project carries them (payment-blueprint's
+ * qa/test/**, 2026-09-03). Every `.mjs` under it, recursively, is in the
+ * region: the tests that prove the gates are locked WITH the gates, or the
+ * lane can no longer tell you that the suite vouching for its verdicts is the
+ * one it was locked with — a narrower claim in the same words, which is the
+ * failure this mechanism exists to prevent. A Compose app has no qa/test and
+ * its region (and lock) is unchanged.
+ */
+export const HARNESS_TEST_DIR = "qa/test";
+
+/**
+ * DECLARATIONS the lane READS to decide what it attests — locked for the same
+ * reason verify.mjs is. payment-blueprint's planted proof (2026-09-03): remove
+ * one entry from qa/verified-surface.json and 203 files — the whole backend —
+ * stop being attested; the next lane run mints a fresh receipt over the smaller
+ * surface, harnessIntegrity PASS, nothing in the chain says the coverage moved.
+ * An edited checker and an edited definition of what the checker looks at are
+ * the same attack. State a lane WRITES (approvals.json, comments.json, the
+ * journal, evidence/) stays out — that is the EXCLUDED_PREFIXES distinction.
+ * Neither file exists in a Compose app by default; its region is unchanged.
+ */
+export const HARNESS_DECLARATIONS = ["qa/verified-surface.json", "qa/harness-manifest.json"];
+
 /**
  * Is this project-relative path part of the machine-owned harness region?
  * @param {string} relPath project-relative path, "/"-separated
  * @returns {boolean}
  */
 export function isHarnessFile(relPath) {
-  if (typeof relPath !== "string" || !relPath.endsWith(".mjs")) return false;
+  if (typeof relPath !== "string") return false;
+  if (HARNESS_DECLARATIONS.includes(relPath)) return true;
+  if (!relPath.endsWith(".mjs")) return false;
+  if (relPath.startsWith(`${HARNESS_TEST_DIR}/`)) return true;
   const dir = relPath.includes("/") ? relPath.slice(0, relPath.lastIndexOf("/")) : "";
   return HARNESS_DIRS.includes(dir);
 }
 
+function walkMjs(dirAbs, relPrefix, out) {
+  let entries;
+  try {
+    entries = fs.readdirSync(dirAbs, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const ent of entries) {
+    const rel = `${relPrefix}/${ent.name}`;
+    if (ent.isDirectory()) walkMjs(path.join(dirAbs, ent.name), rel, out);
+    else if (ent.isFile() && isHarnessFile(rel)) out.push(rel);
+  }
+}
+
 /**
  * Every machine-owned file present under `root`, as project-relative posix
  * paths, sorted — so the list (and any hash over it) is deterministic.
@@ -85,7 +126,14 @@ export function listHarnessFiles(root) {
       if (isHarnessFile(rel)) found.push(rel);
     }
   }
-  return found.sort();
+  walkMjs(path.join(root, HARNESS_TEST_DIR), HARNESS_TEST_DIR, found);
+  // A declaration directly under qa/ is already seen by the scan above (it is
+  // a harness file by name); the explicit loop covers one that lives deeper.
+  // Deduplicated so no path is hashed twice.
+  for (const rel of HARNESS_DECLARATIONS) {
+    if (fs.existsSync(path.join(root, ...rel.split("/")))) found.push(rel);
+  }
+  return [...new Set(found)].sort();
 }
 
 /** sha256 of one file's bytes, hex. */