harnery 0.23.0 → 0.25.0

package/README.md

@@ -22,7 +22,7 @@
 - **Multi-agent coordination:** per-agent heartbeats in `.harnery/active/`, claim-time and commit-time guards, the canonical event stream, councils, a decision docket, per-agent scratchpads, and harness adapters for Claude Code / Cursor / Codex.
 - **Cross-machine presence:** sessions on every machine that shares a repo see each other, labeled by machine. Zero-config over the repo's own git remote (presence refs), with an optional live-socket upgrade via an end-to-end-encrypted relay — the public `relay.harnery.com`, or self-host with `harn relay serve` / the bundled Cloudflare Worker (`relay/worker/`). The relay sees only ciphertext in opaquely-named rooms.
 - **Coordination-aware workflows:** `harn workflow run <script>` executes bounded, schema-gated multi-subagent workflow scripts — plain JS stages fanning out to headless harness-CLI subagents that are born coordination-registered (heartbeats, events, claim guards), with deterministic code deciding the routing between stages. An optional host-owned policy gates dispatch and declared external mutations with `ALLOW`, `ASK`, and `DENY`; CLI `ASK` requests park durably for an explicit approve/deny and same-run resume, while library callers remain fail-closed by default.
-- **Optional isolated workspaces:** add `--isolation worktree --workspace-root <dir>` to run a workflow in a host-owned local Git worktree. Harnery freezes the allocation and provider identity, verifies the workspace before execution and resume, requires review and policy authority before fast-forward integration, and keeps cleanup conservative. `harn workflow workspace <run-id>` and the dashboard show the validated lifecycle; shared execution remains the default.
+- **Optional isolated workspaces:** add `--isolation worktree --workspace-root <dir>` to run a workflow in a host-owned local Git worktree. Harnery freezes the allocation and provider identity, verifies the workspace before execution and resume, requires review and policy authority before fast-forward integration, and keeps cleanup conservative. Inspect with `harn workflow workspace`, then use the separate `workflow integration prepare`, `integration apply`, and `cleanup` phases; shared execution remains the default.
 - **Durable work above attempts:** `harn work` preserves an objective across bounded workflow attempts, dependencies, approval parks, failures, and review. Reusable workflow code receives the exact work ID, title, objective, acceptance criteria, and attempt identity as frozen typed context. A retry also receives the prior run's bounded error and unresolved proof criteria, while retry authority and attempt ceilings remain unchanged. The manifest, proof, and append-only ledger bind the same context, and the one-shot reconciler reports the next explicit action without silently spawning, retrying, or accepting work.
 - **Bounded goal supervision:** `harn supervisor` freezes a mission or existing root graph, specialist team, and safety limits, then runs scheduling cycles until reviewed mission success, human attention, no progress, or budget exhaustion. Its optional planner can create the first milestone, reassess accepted milestone proof, or recover a terminal graph using only a frozen workflow-template catalog. Plans can require independent bounded specialist review before ordinary approval or auto-apply authority, old generations remain immutable evidence, and all attempts still consume the goal budget. Use explicit foreground ticks or enroll goals in the optional heartbeat-backed background service.
 - **Standalone web UI:** `harn web up` boots a local Next.js dashboard for the coord layer, councils, per-project state, and a local coding-agent status view (Claude Code / Codex / Cursor usage, backed by `harn devtools`). Ships with the git clone, not the npm package (see [Install](#install)).

package/dist/commands/harness.d.ts

@@ -1,8 +1,9 @@
 import type { Command } from "commander";
 import type { EmitContext } from "../commander.js";
-import { type BenchResult, type HarnessBenchReport } from "../core/harnesses/index.js";
+import { type BenchResult, type HarnessAttestationReport, type HarnessBenchReport } from "../core/harnesses/index.js";
 import type { HarnessProfile } from "../core/harnesses/types.js";
 export declare function registerHarnessCommand(program: Command, emit: EmitContext): void;
+export declare function renderAttestationReport(report: HarnessAttestationReport): string;
 export declare function renderProfileTable(profiles: readonly HarnessProfile[]): string;
 export declare function renderProfile(profile: HarnessProfile): string;
 export declare function renderBenchReport(report: HarnessBenchReport): string;

package/dist/commands/harness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"harness.d.ts","sourceRoot":"","sources":["../../src/commands/harness.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EACL,KAAK,WAAW,EAEhB,KAAK,kBAAkB,EAExB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAYjE,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CA6DhF;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,GAAG,MAAM,CAU9E;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAkB7D;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CAcpE;AAgBD,mFAAmF;AACnF,YAAY,EAAE,WAAW,EAAE,CAAC"}
+{"version":3,"file":"harness.d.ts","sourceRoot":"","sources":["../../src/commands/harness.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EACL,KAAK,WAAW,EAEhB,KAAK,wBAAwB,EAC7B,KAAK,kBAAkB,EAIxB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAiBjE,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CA6IhF;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,CAgBhF;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,GAAG,MAAM,CAU9E;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAkB7D;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CA6BpE;AAgBD,mFAAmF;AACnF,YAAY,EAAE,WAAW,EAAE,CAAC"}

package/dist/commands/harness.js

@@ -1,4 +1,4 @@
-import { createBuiltinHarnessRegistry, runHarnessBench, } from "../core/harnesses/index.js";
+import { createBuiltinHarnessRegistry, listAttestations, runHarnessAttestation, runHarnessBench, } from "../core/harnesses/index.js";
 const registry = createBuiltinHarnessRegistry();
 export function registerHarnessCommand(program, emit) {
     const command = program
@@ -62,6 +62,96 @@ export function registerHarnessCommand(program, emit) {
             emit.setExitCode(1);
         }
     });
+    command
+        .command("attest [harnesses...]")
+        .description("Record what the installed vendor CLIs actually do. Runs one real model turn each; needs --yes.")
+        .option("--yes", "Confirm that this spends real vendor tokens")
+        .option("--timeout <ms>", "Per-harness probe timeout in milliseconds")
+        .option("--json", "Machine-readable attestation report")
+        .action(async (harnesses, opts) => {
+        if (!opts.yes) {
+            emit.error({
+                code: "harness_attest_unconfirmed",
+                message: "harness attest runs one real model turn per harness and spends vendor tokens. Re-run with --yes.",
+            });
+            emit.setExitCode(1);
+            return;
+        }
+        const timeoutMs = opts.timeout ? Number(opts.timeout) : undefined;
+        if (timeoutMs !== undefined && (!Number.isFinite(timeoutMs) || timeoutMs <= 0)) {
+            emit.error({
+                code: "harness_attest_bad_timeout",
+                message: "--timeout must be a positive number",
+            });
+            emit.setExitCode(1);
+            return;
+        }
+        try {
+            const report = await runHarnessAttestation(registry, { harnesses, timeoutMs });
+            if (opts.json) {
+                emit.config({ format: "json" });
+                emit.data(report);
+            }
+            else {
+                emit.text(renderAttestationReport(report));
+            }
+            // A sweep that recorded nothing at all is a failure; a partial sweep is
+            // reported honestly and still exits 0, because a host is not required
+            // to install every vendor CLI.
+            emit.setExitCode(report.recorded === 0 ? 1 : 0);
+        }
+        catch (error) {
+            emit.error({ code: "harness_attest_failed", message: error.message });
+            emit.setExitCode(1);
+        }
+    });
+    command
+        .command("attestations")
+        .description("Show the recorded live attestations without running any model turns.")
+        .option("--json", "Machine-readable attestation list")
+        .action((opts) => {
+        try {
+            const records = listAttestations();
+            if (opts.json) {
+                emit.config({ format: "json" });
+                emit.data({ attestations: records });
+                return;
+            }
+            if (records.length === 0) {
+                emit.text("No attestations recorded. Run `harness attest --yes` to create one.");
+                return;
+            }
+            emit.text(renderTable(["HARNESS", "VERSION", "OBSERVED AT", "OBSERVATIONS"], records.map((record) => [
+                record.harness,
+                record.binary_version,
+                record.observed_at,
+                Object.entries(record.observations)
+                    .map(([dimension, support]) => `${dimension}=${support}`)
+                    .join(" "),
+            ])));
+        }
+        catch (error) {
+            emit.error({ code: "harness_attestations_failed", message: error.message });
+            emit.setExitCode(1);
+        }
+    });
+}
+export function renderAttestationReport(report) {
+    const rows = report.results.map((result) => [
+        result.harness,
+        result.outcome,
+        result.binaryVersion ?? "",
+        result.observations
+            ? Object.entries(result.observations)
+                .map(([dimension, support]) => `${dimension}=${support}`)
+                .join(" ")
+            : result.note,
+    ]);
+    const table = renderTable(["HARNESS", "OUTCOME", "VERSION", "OBSERVED"], rows);
+    const tail = report.incomplete
+        ? "Some harnesses were not attested; their bench rows keep an adapter basis."
+        : "Every selected harness was attested.";
+    return `${table}\n\nrecorded: ${report.recorded}/${report.results.length}\n${tail}`;
 }
 export function renderProfileTable(profiles) {
     const rows = profiles.map((profile) => [
@@ -100,13 +190,25 @@ export function renderBenchReport(report) {
         result.declared,
         result.observed,
         result.verdict,
+        result.basis,
     ]);
-    const table = renderTable(["HARNESS", "DIMENSION", "DECLARED", "OBSERVED", "VERDICT"], rows);
+    const table = renderTable(["HARNESS", "DIMENSION", "DECLARED", "OBSERVED", "VERDICT", "BASIS"], rows);
     const summary = Object.entries(report.summary)
         .filter(([, count]) => count > 0)
         .map(([verdict, count]) => `${verdict}=${count}`)
         .join(", ");
-    return `${table}\n\nmode: ${report.mode} (no model calls)\n${summary}`;
+    const basis = Object.entries(report.basisSummary)
+        .filter(([, count]) => count > 0)
+        .map(([name, count]) => `${name}=${count}`)
+        .join(", ");
+    return [
+        table,
+        "",
+        `mode: ${report.mode} (no model calls)`,
+        summary,
+        `basis: ${basis}`,
+        "adapter = checked against Harnery's planner/normalizer/fixture, not the installed CLI",
+    ].join("\n");
 }
 function renderTable(headers, rows) {
     const widths = headers.map((header, index) => Math.max(header.length, ...rows.map((row) => row[index]?.length ?? 0)));

package/dist/commands/supervisor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../../src/commands/supervisor.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAsEnD,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAgGnF"}
+{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../../src/commands/supervisor.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AA0EnD,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAgGnF"}

package/dist/commands/supervisor.js

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, isAbsolute, resolve } from "node:path";
 import { workflowSubscriptionOnly } from "../core/config.js";
-import { createBuiltinHarnessRegistry } from "../core/harnesses/index.js";
+import { createBuiltinHarnessRegistry, harnessProofInputs, probeBinaryVersion, } from "../core/harnesses/index.js";
 import { findCoordRoot } from "../core/hooks/resolve/coord-root.js";
 import { loadPolicyFile } from "../core/policy/index.js";
 import { approveSupervisorPlan, configureSupervisorService, createSupervisor, listSupervisors, readSupervisor, readSupervisorPlan, readSupervisorServiceConfig, readSupervisorServiceStatus, rejectSupervisorPlan, requestSupervisorServiceStop, retrySupervisorPlan, runSupervisor, runSupervisorServiceDaemon, spawnSupervisorService, supervisorServiceLogPath, } from "../core/supervisor/index.js";
@@ -332,12 +332,7 @@ function serviceEngine(config, registry) {
         cwd: config.engine.cwd,
         subscriptionOnly: config.engine.subscription_only,
         allowApiBilling: config.engine.allow_api_billing,
-        harnessEvidence: Object.fromEntries(registry
-            .list()
-            .map((adapter) => [
-            adapter.profile.id,
-            { toolEvidence: adapter.profile.capabilities.toolEvidence },
-        ])),
+        ...harnessProofInputs(registry.list().map((adapter) => adapter.profile), { versionProbe: probeBinaryVersion }),
         policy: config.engine.policy,
         approvalMode: "park",
         approvalAddressee: config.engine.approval_addressee,
@@ -413,12 +408,7 @@ function registerRunCommand(supervisor, mode, registry, emit) {
                     cwd: opts.cwd,
                     subscriptionOnly: opts.subscriptionOnly === true ? true : workflowSubscriptionOnly(coordRoot),
                     allowApiBilling: opts.allowApiBilling,
-                    harnessEvidence: Object.fromEntries(registry
-                        .list()
-                        .map((adapter) => [
-                        adapter.profile.id,
-                        { toolEvidence: adapter.profile.capabilities.toolEvidence },
-                    ])),
+                    ...harnessProofInputs(registry.list().map((adapter) => adapter.profile), { versionProbe: probeBinaryVersion }),
                     policy: opts.policy ? loadPolicyFile(opts.policy) : undefined,
                     approvalMode: "park",
                     approvalAddressee: opts.approvalTo,

package/dist/commands/work.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"work.d.ts","sourceRoot":"","sources":["../../src/commands/work.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAmDnD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CA8F7E"}
+{"version":3,"file":"work.d.ts","sourceRoot":"","sources":["../../src/commands/work.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAuDnD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CA8F7E"}

package/dist/commands/work.js

@@ -1,5 +1,5 @@
 import { workflowSubscriptionOnly } from "../core/config.js";
-import { createBuiltinHarnessRegistry } from "../core/harnesses/index.js";
+import { createBuiltinHarnessRegistry, harnessProofInputs, probeBinaryVersion, } from "../core/harnesses/index.js";
 import { findCoordRoot } from "../core/hooks/resolve/coord-root.js";
 import { loadPolicyFile } from "../core/policy/index.js";
 import { acceptWorkItem, cancelWorkItem, createWorkItem, listWorkItems, readWorkItem, reconcileAllWorkItems, reconcileWorkItem, reopenWorkItem, runWorkItem, } from "../core/work/index.js";
@@ -132,12 +132,7 @@ function registerRunCommand(work, name, retry, registry, harnesses, emit) {
                         cwd: opts.cwd,
                         subscriptionOnly: opts.subscriptionOnly === true ? true : workflowSubscriptionOnly(coordRoot),
                         allowApiBilling: opts.allowApiBilling,
-                        harnessEvidence: Object.fromEntries(registry
-                            .list()
-                            .map((adapter) => [
-                            adapter.profile.id,
-                            { toolEvidence: adapter.profile.capabilities.toolEvidence },
-                        ])),
+                        ...harnessProofInputs(registry.list().map((adapter) => adapter.profile), { versionProbe: probeBinaryVersion }),
                         policy: opts.policy ? loadPolicyFile(opts.policy) : undefined,
                         approvalMode: "park",
                         approvalAddressee: opts.approvalTo,

package/dist/commands/workflow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../../src/commands/workflow.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAiDnD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAmejF"}
+{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../../src/commands/workflow.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAqEnD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CA6pBjF"}

package/dist/commands/workflow.js

@@ -1,6 +1,7 @@
-import { resolve } from "node:path";
-import { workflowSubscriptionOnly } from "../core/config.js";
-import { createBuiltinHarnessRegistry } from "../core/harnesses/index.js";
+import { existsSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { resolveBinName, workflowSubscriptionOnly } from "../core/config.js";
+import { createBuiltinHarnessRegistry, harnessProofInputs, probeBinaryVersion, } from "../core/harnesses/index.js";
 import { findCoordRoot } from "../core/hooks/resolve/coord-root.js";
 import { loadPolicyFile } from "../core/policy/index.js";
 import { WorkflowParkedError } from "../core/workflow/engine.js";
@@ -87,12 +88,7 @@ export function registerWorkflowCommand(program, emit) {
                 maxAgents: opts.maxAgents ? Number.parseInt(opts.maxAgents, 10) : undefined,
                 concurrency: opts.concurrency ? Number.parseInt(opts.concurrency, 10) : undefined,
                 cwd: opts.cwd,
-                harnessEvidence: Object.fromEntries(registry
-                    .list()
-                    .map((adapter) => [
-                    adapter.profile.id,
-                    { toolEvidence: adapter.profile.capabilities.toolEvidence },
-                ])),
+                ...harnessProofInputs(registry.list().map((adapter) => adapter.profile), { versionProbe: probeBinaryVersion }),
                 policy: opts.policy ? loadPolicyFile(opts.policy) : undefined,
                 approvalMode: "park",
                 approvalAddressee: opts.approvalTo,
@@ -134,7 +130,7 @@ export function registerWorkflowCommand(program, emit) {
                 else {
                     emit.text(`run ${err.runId} parked\napproval: ${err.approvalId}\n` +
                         `journal: ${err.journalPath}\n` +
-                        `resume after resolution: harn workflow resume ${err.runId}\n`);
+                        `resume after resolution: ${resolveBinName()} workflow resume ${err.runId}\n`);
                 }
                 return;
             }
@@ -178,12 +174,7 @@ export function registerWorkflowCommand(program, emit) {
                         writableRoots: [binding.writable_root.configured],
                     }
                     : undefined,
-                harnessEvidence: Object.fromEntries(registry
-                    .list()
-                    .map((adapter) => [
-                    adapter.profile.id,
-                    { toolEvidence: adapter.profile.capabilities.toolEvidence },
-                ])),
+                ...harnessProofInputs(registry.list().map((adapter) => adapter.profile), { versionProbe: probeBinaryVersion }),
             });
             if (opts.json) {
                 emit.config({ format: "json" });
@@ -288,6 +279,186 @@ export function registerWorkflowCommand(program, emit) {
             : `${inspection.run_id}\tinvalid\t${inspection.error}`)
             .join("\n")}\n`);
     });
+    const integration = workflow
+        .command("integration")
+        .description("Prepare and apply proof-gated isolated-workspace integration.");
+    integration
+        .command("prepare <run-id>")
+        .description("Preview integration and write exact review and policy authority.")
+        .option("--policy <file>", "Current host policy JSON/JSONC for the Git mutation")
+        .option("--reviewer <name>", "Explicit reviewer for a standalone workflow")
+        .option("--reason <text>", "Reason recorded with the standalone review")
+        .option("--target-root <dir>", "Explicit target checkout (default: frozen source checkout)")
+        .option("--accept-unknown <code>", "Accept one verification unknown by code (repeatable)", collectOption, [])
+        .option("--approval-to <address>", "Address a durable policy ASK request")
+        .option("--json", "Emit the durable integration plan as JSON")
+        .action(async (runId, opts) => {
+        const coordRoot = findCoordRoot();
+        if (!coordRoot) {
+            emit.error({
+                code: "no_coord_root",
+                message: "no .harnery/ coordination root found; run `init` first",
+            });
+            process.exit(1);
+        }
+        if (!opts.policy) {
+            emit.error({
+                code: "integration_policy_required",
+                message: "integration prepare requires --policy <file>",
+            });
+            process.exit(1);
+        }
+        if (opts.reason && !opts.reviewer) {
+            emit.error({
+                code: "integration_reviewer_required",
+                message: "--reason requires --reviewer <name>",
+            });
+            process.exit(1);
+        }
+        try {
+            const provider = await builtInProviderForRun(coordRoot, runId);
+            const { IntegrationPrepareParkedError, prepareIntegration } = await import("../core/workflow/index.js");
+            try {
+                const plan = await prepareIntegration({
+                    coordRoot,
+                    runId,
+                    provider,
+                    policy: loadPolicyFile(opts.policy),
+                    targetRoot: opts.targetRoot,
+                    review: opts.reviewer ? { actor: opts.reviewer, reason: opts.reason } : undefined,
+                    acceptedUnknowns: opts.acceptUnknown,
+                    approvalAddressee: opts.approvalTo,
+                });
+                if (opts.json) {
+                    emit.config({ format: "json" });
+                    emit.data(plan);
+                    return;
+                }
+                emit.text(`integration plan ${plan.plan_id} authorized\n` +
+                    `source: ${plan.provider_preview.source_commit}\n` +
+                    `target: ${plan.provider_preview.target_ref} at ${plan.provider_preview.target_commit}\n` +
+                    `changes: ${plan.provider_preview.changed_paths.length}\n` +
+                    `apply: ${resolveBinName()} workflow integration apply ${runId} --yes\n`);
+            }
+            catch (error) {
+                if (error instanceof IntegrationPrepareParkedError) {
+                    if (opts.json) {
+                        emit.config({ format: "json" });
+                        emit.data({
+                            status: "parked",
+                            runId: error.runId,
+                            planId: error.planId,
+                            approvalId: error.approvalId,
+                        });
+                    }
+                    else {
+                        emit.text(`integration preparation parked\n` +
+                            `run: ${error.runId}\n` +
+                            `plan: ${error.planId}\n` +
+                            `approval: ${error.approvalId}\n` +
+                            `approve: ${resolveBinName()} workflow approvals approve ${error.approvalId}\n`);
+                    }
+                    return;
+                }
+                throw error;
+            }
+        }
+        catch (error) {
+            emit.error({
+                code: "workflow_integration_prepare_failed",
+                message: error instanceof Error ? error.message : String(error),
+            });
+            process.exit(1);
+        }
+    });
+    integration
+        .command("apply <run-id>")
+        .description("Apply an authorized durable integration plan.")
+        .option("--yes", "Confirm the target-branch mutation")
+        .option("--json", "Emit the durable integration receipt as JSON")
+        .action(async (runId, opts) => {
+        const coordRoot = findCoordRoot();
+        if (!coordRoot) {
+            emit.error({
+                code: "no_coord_root",
+                message: "no .harnery/ coordination root found; run `init` first",
+            });
+            process.exit(1);
+        }
+        if (!opts.yes) {
+            emit.error({
+                code: "integration_confirmation_required",
+                message: "integration apply changes the target branch; pass --yes to confirm",
+            });
+            process.exit(1);
+        }
+        try {
+            const provider = await builtInProviderForRun(coordRoot, runId);
+            const { applyIntegration } = await import("../core/workflow/index.js");
+            const receipt = await applyIntegration({ coordRoot, runId, provider });
+            if (opts.json) {
+                emit.config({ format: "json" });
+                emit.data(receipt);
+                return;
+            }
+            emit.text(`integration ${receipt.status}: ${receipt.target_ref} at ${receipt.target_commit}\n` +
+                `receipt: ${receipt.receipt_id}\n` +
+                `cleanup: ${resolveBinName()} workflow cleanup ${runId} --yes\n`);
+        }
+        catch (error) {
+            emit.error({
+                code: "workflow_integration_apply_failed",
+                message: error instanceof Error ? error.message : String(error),
+            });
+            process.exit(1);
+        }
+    });
+    workflow
+        .command("cleanup <run-id>")
+        .description("Conservatively release a provider-owned isolated workspace.")
+        .option("--yes", "Confirm the worktree and provider-branch removal attempt")
+        .option("--json", "Emit the cleanup attempt or receipt as JSON")
+        .action(async (runId, opts) => {
+        const coordRoot = findCoordRoot();
+        if (!coordRoot) {
+            emit.error({
+                code: "no_coord_root",
+                message: "no .harnery/ coordination root found; run `init` first",
+            });
+            process.exit(1);
+        }
+        if (!opts.yes) {
+            emit.error({
+                code: "cleanup_confirmation_required",
+                message: "workspace cleanup may remove a worktree and branch; pass --yes to confirm",
+            });
+            process.exit(1);
+        }
+        try {
+            const provider = await builtInProviderForRun(coordRoot, runId);
+            const { cleanupWorkspace } = await import("../core/workflow/index.js");
+            const result = await cleanupWorkspace({ coordRoot, runId, provider });
+            if (opts.json) {
+                emit.config({ format: "json" });
+                emit.data(result);
+                return;
+            }
+            const receipt = "receipt_id" in result && typeof result.receipt_id === "string"
+                ? `\nreceipt: ${result.receipt_id}`
+                : "";
+            const reason = "reason" in result && typeof result.reason === "string"
+                ? `\nreason: ${result.reason}`
+                : "";
+            emit.text(`workspace cleanup ${result.status}: ${result.binding_id}${receipt}${reason}\n`);
+        }
+        catch (error) {
+            emit.error({
+                code: "workflow_cleanup_failed",
+                message: error instanceof Error ? error.message : String(error),
+            });
+            process.exit(1);
+        }
+    });
     const approvals = workflow
         .command("approvals")
         .description("Inspect and resolve durable workflow policy approvals.");
@@ -379,7 +550,7 @@ export function registerWorkflowCommand(program, emit) {
                 else {
                     emit.text(`${renderWorkflowApproval(resolved.approval)}` +
                         `${resolved.applied ? "decision recorded" : "decision already recorded"}\n` +
-                        `resume: harn workflow resume ${resolved.approval.request.run_id}\n`);
+                        approvalNextActionHint(coordRoot, resolved.approval));
                 }
             }
             catch (err) {
@@ -422,3 +593,30 @@ export function registerWorkflowCommand(program, emit) {
         }
     });
 }
+async function builtInProviderForRun(coordRoot, runId) {
+    const { createLocalGitWorktreeProvider, readWorkflowRunManifest } = await import("../core/workflow/index.js");
+    const manifest = readWorkflowRunManifest(coordRoot, runId);
+    const binding = manifest.execution.workspace_binding;
+    if (!binding) {
+        throw new Error(`workflow run ${runId} has no isolated workspace binding`);
+    }
+    if (binding.provider.id !== "local-git-worktree") {
+        throw new Error(`workflow run ${runId} requires unavailable workspace provider ${binding.provider.id}`);
+    }
+    return createLocalGitWorktreeProvider({ coordRoot });
+}
+function collectOption(value, previous) {
+    return [...previous, value];
+}
+/** Next operator command after resolving an approval. Mid-run parks resume the
+ * workflow; integration prepare parks after the run is already terminal, so
+ * the durable plan is authorized by re-running prepare (resume would fail). */
+function approvalNextActionHint(coordRoot, approval) {
+    const bin = resolveBinName();
+    const runId = approval.request.run_id;
+    const integrationPlanPath = join(coordRoot, ".harnery", "workflows", runId, "integration", "plan.json");
+    if (existsSync(integrationPlanPath)) {
+        return `prepare: ${bin} workflow integration prepare ${runId}\n`;
+    }
+    return `resume: ${bin} workflow resume ${runId}\n`;
+}

package/dist/core/harnesses/attest.d.ts

@@ -0,0 +1,48 @@
+/**
+ * The opt-in live probe that produces an attestation (ADR 0038).
+ *
+ * One bounded turn per harness, through the same `spawn` the workflow engine
+ * uses, so what gets attested is the path production takes rather than a
+ * parallel test rig.
+ */
+import type { SpawnResult } from "../workflow/types.js";
+import type { AttestableDimension, HarnessAttestation } from "./attestation.js";
+import type { HarnessRegistry } from "./registry.js";
+import type { CapabilitySupport, HarnessId } from "./types.js";
+/** Fixed and content-free, so nothing user-supplied can reach the record and
+ * the turn stays as cheap as a turn can be. */
+export declare const ATTESTATION_PROMPT = "Reply with the single word: ok";
+export declare const DEFAULT_ATTESTATION_TIMEOUT_MS = 120000;
+export type AttestationOutcome = "recorded" | "skipped" | "unreachable" | "failed";
+export interface HarnessAttestationResult {
+    harness: HarnessId;
+    outcome: AttestationOutcome;
+    binaryVersion?: string;
+    observations?: Partial<Record<AttestableDimension, CapabilitySupport>>;
+    durationMs?: number;
+    note: string;
+}
+export interface HarnessAttestationReport {
+    generatedAt: string;
+    harnesses: HarnessId[];
+    results: HarnessAttestationResult[];
+    recorded: number;
+    /** True when at least one selected harness could not be attested, so a
+     * caller can tell a partial sweep from a complete one. */
+    incomplete: boolean;
+}
+export interface RunHarnessAttestationOptions {
+    harnesses?: readonly string[];
+    timeoutMs?: number;
+    cwd?: string;
+    coordRoot?: string;
+    /** Test seam and alternate host probe. A null version means unavailable. */
+    versionProbe?: (binary: string) => string | null;
+    /** Test seam. Defaults to the adapter's production spawner. */
+    spawn?: (harness: HarnessId, prompt: string, timeoutMs: number) => Promise<SpawnResult>;
+    /** Test seam. Defaults to writing under the coord root. */
+    persist?: (record: HarnessAttestation) => void;
+    now?: () => Date;
+}
+export declare function runHarnessAttestation(registry: HarnessRegistry, opts?: RunHarnessAttestationOptions): Promise<HarnessAttestationReport>;
+//# sourceMappingURL=attest.d.ts.map

package/dist/core/harnesses/attest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attest.d.ts","sourceRoot":"","sources":["../../../src/core/harnesses/attest.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,KAAK,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAGhF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE/D;+CAC+C;AAC/C,eAAO,MAAM,kBAAkB,mCAAmC,CAAC;AAEnE,eAAO,MAAM,8BAA8B,SAAU,CAAC;AAetD,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,SAAS,GAAG,aAAa,GAAG,QAAQ,CAAC;AAEnF,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,SAAS,CAAC;IACnB,OAAO,EAAE,kBAAkB,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,SAAS,EAAE,CAAC;IACvB,OAAO,EAAE,wBAAwB,EAAE,CAAC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB;8DAC0D;IAC1D,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,4BAA4B;IAC3C,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACjD,+DAA+D;IAC/D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IACxF,2DAA2D;IAC3D,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,IAAI,CAAC;IAC/C,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,eAAe,EACzB,IAAI,GAAE,4BAAiC,GACtC,OAAO,CAAC,wBAAwB,CAAC,CAyFnC"}