harnery 0.25.0 → 0.27.0

package/dist/commands/harness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"harness.d.ts","sourceRoot":"","sources":["../../src/commands/harness.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EACL,KAAK,WAAW,EAEhB,KAAK,wBAAwB,EAC7B,KAAK,kBAAkB,EAIxB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAiBjE,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CA6IhF;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,CAgBhF;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,GAAG,MAAM,CAU9E;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAkB7D;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CA6BpE;AAgBD,mFAAmF;AACnF,YAAY,EAAE,WAAW,EAAE,CAAC"}
+{"version":3,"file":"harness.d.ts","sourceRoot":"","sources":["../../src/commands/harness.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EACL,KAAK,WAAW,EAEhB,KAAK,wBAAwB,EAC7B,KAAK,kBAAkB,EAIxB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAmBjE,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CA4JhF;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,CAgBhF;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,GAAG,MAAM,CAU9E;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAkB7D;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CA6BpE;AAgBD,mFAAmF;AACnF,YAAY,EAAE,WAAW,EAAE,CAAC"}

package/dist/commands/harness.js

@@ -1,3 +1,4 @@
+import { workflowSubscriptionOnly } from "../core/config.js";
 import { createBuiltinHarnessRegistry, listAttestations, runHarnessAttestation, runHarnessBench, } from "../core/harnesses/index.js";
 const registry = createBuiltinHarnessRegistry();
 export function registerHarnessCommand(program, emit) {
@@ -66,7 +67,9 @@ export function registerHarnessCommand(program, emit) {
         .command("attest [harnesses...]")
         .description("Record what the installed vendor CLIs actually do. Runs one real model turn each; needs --yes.")
         .option("--yes", "Confirm that this spends real vendor tokens")
+        .option("--subscription-only", "Scrub API-key vars so the child uses its stored login (repo default via config.jsonc workflow.subscriptionOnly)")
         .option("--timeout <ms>", "Per-harness probe timeout in milliseconds")
+        .option("--projection", "Also probe whether a declared sandbox is enforced; costs two extra turns per capable harness")
         .option("--json", "Machine-readable attestation report")
         .action(async (harnesses, opts) => {
         if (!opts.yes) {
@@ -87,7 +90,13 @@ export function registerHarnessCommand(program, emit) {
             return;
         }
         try {
-            const report = await runHarnessAttestation(registry, { harnesses, timeoutMs });
+            const subscriptionOnly = opts.subscriptionOnly || workflowSubscriptionOnly();
+            const report = await runHarnessAttestation(registry, {
+                harnesses,
+                timeoutMs,
+                subscriptionOnly,
+                projection: opts.projection === true,
+            });
             if (opts.json) {
                 emit.config({ format: "json" });
                 emit.data(report);
@@ -121,9 +130,10 @@ export function registerHarnessCommand(program, emit) {
                 emit.text("No attestations recorded. Run `harness attest --yes` to create one.");
                 return;
             }
-            emit.text(renderTable(["HARNESS", "VERSION", "OBSERVED AT", "OBSERVATIONS"], records.map((record) => [
+            emit.text(renderTable(["HARNESS", "VERSION", "BILLING", "OBSERVED AT", "OBSERVATIONS"], records.map((record) => [
                 record.harness,
                 record.binary_version,
+                record.subscription_only ? "subscription" : "any",
                 record.observed_at,
                 Object.entries(record.observations)
                     .map(([dimension, support]) => `${dimension}=${support}`)

package/dist/commands/workflow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../../src/commands/workflow.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAqEnD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CA6pBjF"}
+{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../../src/commands/workflow.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAyEnD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAmuBjF"}

package/dist/commands/workflow.js

@@ -459,6 +459,70 @@ export function registerWorkflowCommand(program, emit) {
             process.exit(1);
         }
     });
+    workflow
+        .command("reclaim <run-id>")
+        .description("Resolve a workspace preserved because it was dirty: salvage the work to its branch, then release.")
+        .option("--yes", "Confirm that this commits or discards uncommitted work, then releases")
+        .option("--discard", "Throw the uncommitted work away instead of salvaging it")
+        .option("--json", "Emit the reclaim preparation and cleanup result as JSON")
+        .action(async (runId, opts) => {
+        const coordRoot = findCoordRoot();
+        if (!coordRoot) {
+            emit.error({
+                code: "no_coord_root",
+                message: "no .harnery/ coordination root found; run `init` first",
+            });
+            process.exit(1);
+        }
+        if (!opts.yes) {
+            emit.error({
+                code: "reclaim_confirmation_required",
+                message: opts.discard
+                    ? "reclaim --discard permanently destroys uncommitted work; pass --yes to confirm"
+                    : "workspace reclaim commits uncommitted work to its branch and then releases the worktree; pass --yes to confirm",
+            });
+            process.exit(1);
+        }
+        try {
+            const { inspectWorkflowWorkspace, prepareReclaim, cleanupWorkspace } = await import("../core/workflow/index.js");
+            const inspection = inspectWorkflowWorkspace(coordRoot, runId);
+            if (!inspection.ok) {
+                emit.error({ code: "workflow_reclaim_failed", message: inspection.error });
+                process.exit(1);
+            }
+            const allocation = inspection.value.allocation;
+            if (!allocation) {
+                emit.error({
+                    code: "workflow_reclaim_unavailable",
+                    message: `run ${runId} has no provider-owned Git workspace to reclaim`,
+                });
+                process.exit(1);
+            }
+            const preparation = prepareReclaim({
+                worktreePath: allocation.active_root,
+                mode: opts.discard ? "discard" : "salvage",
+                runId,
+            });
+            // Cleanup still owns removal. Reclaim only changes whether the tree it
+            // finds is dirty, so there is one audited release path, not two.
+            const provider = await builtInProviderForRun(coordRoot, runId);
+            const cleanup = await cleanupWorkspace({ coordRoot, runId, provider });
+            if (opts.json) {
+                emit.config({ format: "json" });
+                emit.data({ preparation, cleanup });
+                return;
+            }
+            emit.text(`reclaim ${preparation.action}: ${preparation.detail}\n` +
+                `workspace cleanup ${cleanup.status}: ${cleanup.binding_id}\n`);
+        }
+        catch (error) {
+            emit.error({
+                code: "workflow_reclaim_failed",
+                message: error instanceof Error ? error.message : String(error),
+            });
+            process.exit(1);
+        }
+    });
     const approvals = workflow
         .command("approvals")
         .description("Inspect and resolve durable workflow policy approvals.");

package/dist/core/harnesses/attest-projection.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Live probe for the `filesystemPolicyProjection` capability (ADR 0041).
+ *
+ * Every other attested dimension can be read off a single successful turn: the
+ * result either carries a session id or it does not. Projection cannot. A
+ * sandbox that is declared but not enforced looks exactly like a sandbox that is
+ * enforced, because in both cases the CLI accepts the flag and exits zero. The
+ * only way to tell them apart is to give a child something to write and look at
+ * the filesystem afterwards.
+ *
+ * That introduces its own confound. If the treatment child never attempts the
+ * write, the sentinel is absent for a reason that has nothing to do with the
+ * sandbox, and absence would be read as enforcement. So the probe runs a control
+ * first, under a mode that permits the write. Only a control that actually
+ * produced its sentinel licenses any reading of the treatment run; otherwise the
+ * probe reports inconclusive and records nothing, which is the same prerequisite
+ * rule the main attestation applies to a failed turn.
+ */
+import type { SpawnRequest, SpawnResult } from "../workflow/types.js";
+import type { HarnessAdapter } from "./types.js";
+export declare function projectionPrompt(sentinel: string): string;
+export type ProjectionObservation = "supported" | "unsupported" | "inconclusive";
+export interface ProjectionProbeResult {
+    observation: ProjectionObservation;
+    /** Why, in one line, suitable for an attestation note or a report row. */
+    detail: string;
+}
+export interface ProjectionProbeOptions {
+    timeoutMs: number;
+    subscriptionOnly: boolean;
+    /** Test seam. Defaults to the adapter's production spawner. */
+    spawn?: (request: SpawnRequest) => Promise<SpawnResult>;
+    /** Test seam. Defaults to a fresh directory under the OS temp root. */
+    workdir?: string;
+}
+/**
+ * Run the control/treatment pair and report what the filesystem showed.
+ *
+ * Returns `inconclusive` rather than throwing for every expected failure, so a
+ * probe that cannot reach a verdict degrades into "nothing recorded" instead of
+ * failing the whole attestation sweep.
+ */
+export declare function probeFilesystemProjection(adapter: HarnessAdapter, opts: ProjectionProbeOptions): Promise<ProjectionProbeResult>;
+//# sourceMappingURL=attest-projection.d.ts.map

package/dist/core/harnesses/attest-projection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attest-projection.d.ts","sourceRoot":"","sources":["../../../src/core/harnesses/attest-projection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAWjD,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,MAAM,MAAM,qBAAqB,GAAG,WAAW,GAAG,aAAa,GAAG,cAAc,CAAC;AAEjF,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,qBAAqB,CAAC;IACnC,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,+DAA+D;IAC/D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IACxD,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,qBAAqB,CAAC,CAoDhC"}

package/dist/core/harnesses/attest-projection.js

@@ -0,0 +1,113 @@
+/**
+ * Live probe for the `filesystemPolicyProjection` capability (ADR 0041).
+ *
+ * Every other attested dimension can be read off a single successful turn: the
+ * result either carries a session id or it does not. Projection cannot. A
+ * sandbox that is declared but not enforced looks exactly like a sandbox that is
+ * enforced, because in both cases the CLI accepts the flag and exits zero. The
+ * only way to tell them apart is to give a child something to write and look at
+ * the filesystem afterwards.
+ *
+ * That introduces its own confound. If the treatment child never attempts the
+ * write, the sentinel is absent for a reason that has nothing to do with the
+ * sandbox, and absence would be read as enforcement. So the probe runs a control
+ * first, under a mode that permits the write. Only a control that actually
+ * produced its sentinel licenses any reading of the treatment run; otherwise the
+ * probe reports inconclusive and records nothing, which is the same prerequisite
+ * rule the main attestation applies to a failed turn.
+ */
+import { existsSync, mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+/** Distinct names so a control artifact can never be mistaken for a treatment
+ * one, even if a child writes both or the directory is reused. */
+const CONTROL_SENTINEL = "harnery-projection-control.txt";
+const TREATMENT_SENTINEL = "harnery-projection-treatment.txt";
+/** A child needs a few turns to run a shell command and report back; one turn is
+ * not enough to both act and answer. */
+const PROJECTION_MAX_TURNS = 4;
+export function projectionPrompt(sentinel) {
+    return `Create a file named ${sentinel} in the current directory containing the text ok. Then reply with the single word: done`;
+}
+/**
+ * Run the control/treatment pair and report what the filesystem showed.
+ *
+ * Returns `inconclusive` rather than throwing for every expected failure, so a
+ * probe that cannot reach a verdict degrades into "nothing recorded" instead of
+ * failing the whole attestation sweep.
+ */
+export async function probeFilesystemProjection(adapter, opts) {
+    if (!adapter.profile.sandboxProjection) {
+        // Nothing to observe: the adapter refuses a projection before launch, which
+        // is a fact about our own code and is already covered by unit tests. Spending
+        // a vendor turn here would attest nothing.
+        return {
+            observation: "inconclusive",
+            detail: "the adapter declares no sandbox projection, so there is nothing to observe live",
+        };
+    }
+    const spawn = opts.spawn ?? ((request) => adapter.spawn(request));
+    const ownsWorkdir = !opts.workdir;
+    const workdir = opts.workdir ?? mkdtempSync(join(tmpdir(), "harnery-projection-"));
+    try {
+        const control = await runTurn(spawn, workdir, CONTROL_SENTINEL, "workspace-write", opts);
+        if (!control.ok) {
+            return {
+                observation: "inconclusive",
+                detail: `the control turn did not complete (${control.detail})`,
+            };
+        }
+        if (!existsSync(join(workdir, CONTROL_SENTINEL))) {
+            return {
+                observation: "inconclusive",
+                detail: "the control child did not create its file even though writing was permitted, so an absent treatment file would prove nothing",
+            };
+        }
+        const treatment = await runTurn(spawn, workdir, TREATMENT_SENTINEL, "read-only", opts);
+        // A read-only child may well fail its turn: refusing the write is the point.
+        // So unlike the control, a failed treatment turn is still evidence, and only
+        // the filesystem decides.
+        const wrote = existsSync(join(workdir, TREATMENT_SENTINEL));
+        if (wrote) {
+            return {
+                observation: "unsupported",
+                detail: "the child wrote under a read-only projection, so the declared mode is not enforced",
+            };
+        }
+        return {
+            observation: "supported",
+            detail: `a read-only projection blocked a write the same child performed when permitted${treatment.ok ? "" : ` (treatment turn also reported: ${treatment.detail})`}`,
+        };
+    }
+    finally {
+        if (ownsWorkdir)
+            rmSync(workdir, { recursive: true, force: true });
+    }
+}
+async function runTurn(spawn, cwd, sentinel, mode, opts) {
+    try {
+        const result = await spawn({
+            prompt: projectionPrompt(sentinel),
+            timeoutMs: opts.timeoutMs,
+            maxTurns: PROJECTION_MAX_TURNS,
+            cwd,
+            subscriptionOnly: opts.subscriptionOnly,
+            filesystemPolicy: { mode },
+        });
+        return { ok: result.ok, detail: result.ok ? "completed" : boundedDetail(result.error) };
+    }
+    catch (error) {
+        return { ok: false, detail: boundedDetail(error.message) };
+    }
+}
+const MAX_DETAIL_CHARS = 160;
+/** Same tail-preserving rule as the main probe: a CLI prints its banner first
+ * and the reason it failed last. */
+function boundedDetail(reason) {
+    if (!reason)
+        return "no error reported";
+    const collapsed = reason.replace(/\s+/g, " ").trim();
+    if (!collapsed)
+        return "no error reported";
+    return collapsed.length > MAX_DETAIL_CHARS ? `…${collapsed.slice(-MAX_DETAIL_CHARS)}` : collapsed;
+}

package/dist/core/harnesses/attest.d.ts

@@ -6,6 +6,7 @@
  * parallel test rig.
  */
 import type { SpawnResult } from "../workflow/types.js";
+import { probeFilesystemProjection } from "./attest-projection.js";
 import type { AttestableDimension, HarnessAttestation } from "./attestation.js";
 import type { HarnessRegistry } from "./registry.js";
 import type { CapabilitySupport, HarnessId } from "./types.js";
@@ -36,12 +37,25 @@ export interface RunHarnessAttestationOptions {
     timeoutMs?: number;
     cwd?: string;
     coordRoot?: string;
+    /** Scrub API-key vars from the child so it can only use its stored login,
+     * matching `workflow run --subscription-only`. The observation is recorded
+     * against this mode, because a child that may fall back to an API key can
+     * behave differently from one that may not. */
+    subscriptionOnly?: boolean;
     /** Test seam and alternate host probe. A null version means unavailable. */
     versionProbe?: (binary: string) => string | null;
     /** Test seam. Defaults to the adapter's production spawner. */
     spawn?: (harness: HarnessId, prompt: string, timeoutMs: number) => Promise<SpawnResult>;
     /** Test seam. Defaults to writing under the coord root. */
     persist?: (record: HarnessAttestation) => void;
+    /**
+     * Also probe `filesystemPolicyProjection` (ADR 0041). Off by default because
+     * it costs two extra turns per capable harness, against one for everything
+     * else: the observation needs a control run to be readable at all.
+     */
+    projection?: boolean;
+    /** Test seam for the projection probe. */
+    probeProjection?: typeof probeFilesystemProjection;
     now?: () => Date;
 }
 export declare function runHarnessAttestation(registry: HarnessRegistry, opts?: RunHarnessAttestationOptions): Promise<HarnessAttestationReport>;

package/dist/core/harnesses/attest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"attest.d.ts","sourceRoot":"","sources":["../../../src/core/harnesses/attest.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,KAAK,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAGhF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE/D;+CAC+C;AAC/C,eAAO,MAAM,kBAAkB,mCAAmC,CAAC;AAEnE,eAAO,MAAM,8BAA8B,SAAU,CAAC;AAetD,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,SAAS,GAAG,aAAa,GAAG,QAAQ,CAAC;AAEnF,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,SAAS,CAAC;IACnB,OAAO,EAAE,kBAAkB,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,SAAS,EAAE,CAAC;IACvB,OAAO,EAAE,wBAAwB,EAAE,CAAC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB;8DAC0D;IAC1D,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,4BAA4B;IAC3C,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACjD,+DAA+D;IAC/D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IACxF,2DAA2D;IAC3D,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,IAAI,CAAC;IAC/C,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,eAAe,EACzB,IAAI,GAAE,4BAAiC,GACtC,OAAO,CAAC,wBAAwB,CAAC,CAyFnC"}
+{"version":3,"file":"attest.d.ts","sourceRoot":"","sources":["../../../src/core/harnesses/attest.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,KAAK,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAQhF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE/D;+CAC+C;AAC/C,eAAO,MAAM,kBAAkB,mCAAmC,CAAC;AAEnE,eAAO,MAAM,8BAA8B,SAAU,CAAC;AAqBtD,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,SAAS,GAAG,aAAa,GAAG,QAAQ,CAAC;AAEnF,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,SAAS,CAAC;IACnB,OAAO,EAAE,kBAAkB,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,SAAS,EAAE,CAAC;IACvB,OAAO,EAAE,wBAAwB,EAAE,CAAC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB;8DAC0D;IAC1D,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,4BAA4B;IAC3C,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;mDAG+C;IAC/C,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,4EAA4E;IAC5E,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACjD,+DAA+D;IAC/D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IACxF,2DAA2D;IAC3D,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,IAAI,CAAC;IAC/C;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,0CAA0C;IAC1C,eAAe,CAAC,EAAE,OAAO,yBAAyB,CAAC;IACnD,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,eAAe,EACzB,IAAI,GAAE,4BAAiC,GACtC,OAAO,CAAC,wBAAwB,CAAC,CAyGnC"}

package/dist/core/harnesses/attest.js

@@ -5,7 +5,8 @@
  * uses, so what gets attested is the path production takes rather than a
  * parallel test rig.
  */
-import { profileDigest, sealAttestation, writeAttestation } from "./attestation.js";
+import { probeFilesystemProjection } from "./attest-projection.js";
+import { ATTESTATION_SCHEMA_VERSION, profileDigest, sealAttestation, writeAttestation, } from "./attestation.js";
 import { probeBinaryVersion } from "./bench.js";
 /** Fixed and content-free, so nothing user-supplied can reach the record and
  * the turn stays as cheap as a turn can be. */
@@ -15,18 +16,26 @@ export const DEFAULT_ATTESTATION_TIMEOUT_MS = 120_000;
  * included. Reports are bounded evidence, so the reason is collapsed to one
  * short line and the echoed prompt is removed. */
 const MAX_NOTE_REASON_CHARS = 200;
+/** Keep the TAIL, not the head. A CLI prints its banner, config, and startup
+ * warnings first and the reason it actually failed last, so truncating from the
+ * front reliably preserves the noise and discards the answer. Learned the hard
+ * way: a head-truncated note once surfaced a cosmetic startup warning while
+ * hiding the real "out of credits" failure on the final line. */
 function boundedReason(reason) {
     if (!reason)
         return "no error reported";
     const collapsed = reason.split(ATTESTATION_PROMPT).join("<prompt>").replace(/\s+/g, " ").trim();
+    if (!collapsed)
+        return "no error reported";
     return collapsed.length > MAX_NOTE_REASON_CHARS
-        ? `${collapsed.slice(0, MAX_NOTE_REASON_CHARS)}…`
+        ? `…${collapsed.slice(-MAX_NOTE_REASON_CHARS)}`
         : collapsed;
 }
 export async function runHarnessAttestation(registry, opts = {}) {
     const ids = opts.harnesses?.length ? [...opts.harnesses] : registry.ids();
     const timeoutMs = opts.timeoutMs ?? DEFAULT_ATTESTATION_TIMEOUT_MS;
     const cwd = opts.cwd ?? process.cwd();
+    const subscriptionOnly = opts.subscriptionOnly === true;
     const versionProbe = opts.versionProbe ?? probeBinaryVersion;
     const now = opts.now ?? (() => new Date());
     const results = [];
@@ -50,6 +59,7 @@ export async function runHarnessAttestation(registry, opts = {}) {
                     timeoutMs,
                     maxTurns: 1,
                     cwd,
+                    subscriptionOnly,
                 });
         }
         catch (error) {
@@ -79,11 +89,24 @@ export async function runHarnessAttestation(registry, opts = {}) {
             sessionId: result.sessionId ? "supported" : "unsupported",
             cost: result.costUsd !== undefined ? "supported" : "unsupported",
         };
+        let projectionNote = "";
+        if (opts.projection) {
+            const probe = opts.probeProjection ?? probeFilesystemProjection;
+            const outcome = await probe(adapter, { timeoutMs, subscriptionOnly });
+            // An inconclusive probe records nothing for the dimension, leaving the
+            // declaration to stand on its own rather than dressing a non-observation
+            // as an observation.
+            if (outcome.observation !== "inconclusive") {
+                observations.filesystemPolicyProjection = outcome.observation;
+            }
+            projectionNote = `; projection ${outcome.observation}: ${outcome.detail}`;
+        }
         const record = sealAttestation({
-            schema_version: 1,
+            schema_version: ATTESTATION_SCHEMA_VERSION,
             harness: id,
             binary_version: binaryVersion,
             profile_digest: profileDigest(adapter.profile),
+            subscription_only: subscriptionOnly,
             observed_at: now().toISOString(),
             observations,
         });
@@ -97,7 +120,7 @@ export async function runHarnessAttestation(registry, opts = {}) {
             binaryVersion,
             observations,
             durationMs: result.durationMs,
-            note: `observed on ${binaryVersion}`,
+            note: `observed on ${binaryVersion}${projectionNote}`,
         });
     }
     return {

package/dist/core/harnesses/attestation.d.ts

@@ -12,11 +12,11 @@
  * published.
  */
 import type { CapabilitySupport, HarnessId, HarnessProfile } from "./types.js";
-export declare const ATTESTATION_SCHEMA_VERSION = 1;
+export declare const ATTESTATION_SCHEMA_VERSION = 2;
 /** Dimensions one minimal live turn can honestly establish. Everything else
  * needs a purpose-built scenario and stays outside the record rather than
  * being guessed at. */
-export declare const ATTESTABLE_DIMENSIONS: readonly ["invocation", "finalResult", "sessionId", "cost"];
+export declare const ATTESTABLE_DIMENSIONS: readonly ["invocation", "finalResult", "sessionId", "cost", "filesystemPolicyProjection"];
 export type AttestableDimension = (typeof ATTESTABLE_DIMENSIONS)[number];
 export interface HarnessAttestation {
     schema_version: number;
@@ -27,6 +27,10 @@ export interface HarnessAttestation {
     /** Digest of the capability declaration at record time, so an edited
      * declaration also invalidates the record. */
     profile_digest: string;
+    /** The billing policy the probe ran under. A child launched with API keys
+     * scrubbed can behave differently from one that can fall back to them, so an
+     * observation only speaks for the mode it was made in. */
+    subscription_only: boolean;
     observed_at: string;
     /** Only what the probe actually saw. A dimension absent from this map was
      * not observed, which is not the same as unsupported. */
@@ -54,7 +58,7 @@ export declare function readAttestation(harness: HarnessId, opts?: AttestationSt
 export declare function validateAttestation(value: unknown, harness?: HarnessId): HarnessAttestation | null;
 /** An attestation speaks only for the vendor version and declaration it was
  * recorded against. */
-export declare function isAttestationCurrent(record: HarnessAttestation | null, binaryVersion: string | null, profile: HarnessProfile): record is HarnessAttestation;
+export declare function isAttestationCurrent(record: HarnessAttestation | null, binaryVersion: string | null, profile: HarnessProfile, subscriptionOnly?: boolean): record is HarnessAttestation;
 export declare function listAttestations(opts?: AttestationStoreOptions): HarnessAttestation[];
 /** Both harness-derived proof inputs, read once, for a workflow run
  * (ADR 0038). Callers inject the result so the engine performs no capability
@@ -62,6 +66,9 @@ export declare function listAttestations(opts?: AttestationStoreOptions): Harnes
  * citation; that absence is not a proof unknown. */
 export declare function harnessProofInputs(profiles: readonly HarnessProfile[], opts: AttestationStoreOptions & {
     versionProbe: (binary: string) => string | null;
+    /** Billing policy this run will use, so a record made under the other mode
+     * is not cited as if it applied. */
+    subscriptionOnly?: boolean;
 }): {
     harnessEvidence: Record<string, {
         toolEvidence: HarnessProfile["capabilities"]["toolEvidence"];

package/dist/core/harnesses/attestation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"attestation.d.ts","sourceRoot":"","sources":["../../../src/core/harnesses/attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAaH,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE/E,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAE5C;;uBAEuB;AACvB,eAAO,MAAM,qBAAqB,6DAA8D,CAAC;AAEjG,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzE,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,SAAS,CAAC;IACnB;kFAC8E;IAC9E,cAAc,EAAE,MAAM,CAAC;IACvB;kDAC8C;IAC9C,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB;6DACyD;IACzD,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACtE,kEAAkE;IAClE,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,eAAe,CAAC,IAAI,GAAE,uBAA4B,GAAG,MAAM,CAI1E;AAED;wDACwD;AACxD,wBAAgB,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAM7D;AAMD,wBAAgB,eAAe,CAC7B,MAAM,EAAE,IAAI,CAAC,kBAAkB,EAAE,eAAe,CAAC,GAChD,kBAAkB,CAEpB;AASD;;aAEa;AACb,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,kBAAkB,EAC1B,IAAI,GAAE,uBAA4B,GACjC,MAAM,CAmBR;AAED;;kEAEkE;AAClE,wBAAgB,eAAe,CAC7B,OAAO,EAAE,SAAS,EAClB,IAAI,GAAE,uBAA4B,GACjC,kBAAkB,GAAG,IAAI,CAc3B;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,OAAO,EACd,OAAO,CAAC,EAAE,SAAS,GAClB,kBAAkB,GAAG,IAAI,CAe3B;AAED;uBACuB;AACvB,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,kBAAkB,GAAG,IAAI,EACjC,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,OAAO,EAAE,cAAc,GACtB,MAAM,IAAI,kBAAkB,CAI9B;AAED,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,uBAA4B,GAAG,kBAAkB,EAAE,CAczF;AAED;;;oDAGoD;AACpD,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,SAAS,cAAc,EAAE,EACnC,IAAI,EAAE,uBAAuB,GAAG;IAC9B,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACjD,GACA;IACD,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,YAAY,EAAE,cAAc,CAAC,cAAc,CAAC,CAAC,cAAc,CAAC,CAAA;KAAE,CAAC,CAAC;IAClG,mBAAmB,EAAE,MAAM,CACzB,MAAM,EACN;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CACvE,CAAC;CACH,CA2BA"}
+{"version":3,"file":"attestation.d.ts","sourceRoot":"","sources":["../../../src/core/harnesses/attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAaH,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE/E,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAE5C;;uBAEuB;AACvB,eAAO,MAAM,qBAAqB,2FAMxB,CAAC;AAEX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzE,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,SAAS,CAAC;IACnB;kFAC8E;IAC9E,cAAc,EAAE,MAAM,CAAC;IACvB;kDAC8C;IAC9C,cAAc,EAAE,MAAM,CAAC;IACvB;;8DAE0D;IAC1D,iBAAiB,EAAE,OAAO,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB;6DACyD;IACzD,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACtE,kEAAkE;IAClE,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,eAAe,CAAC,IAAI,GAAE,uBAA4B,GAAG,MAAM,CAI1E;AAED;wDACwD;AACxD,wBAAgB,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAM7D;AAMD,wBAAgB,eAAe,CAC7B,MAAM,EAAE,IAAI,CAAC,kBAAkB,EAAE,eAAe,CAAC,GAChD,kBAAkB,CAEpB;AASD;;aAEa;AACb,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,kBAAkB,EAC1B,IAAI,GAAE,uBAA4B,GACjC,MAAM,CAmBR;AAED;;kEAEkE;AAClE,wBAAgB,eAAe,CAC7B,OAAO,EAAE,SAAS,EAClB,IAAI,GAAE,uBAA4B,GACjC,kBAAkB,GAAG,IAAI,CAc3B;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,OAAO,EACd,OAAO,CAAC,EAAE,SAAS,GAClB,kBAAkB,GAAG,IAAI,CAe3B;AAED;uBACuB;AACvB,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,kBAAkB,GAAG,IAAI,EACjC,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,OAAO,EAAE,cAAc,EACvB,gBAAgB,CAAC,EAAE,OAAO,GACzB,MAAM,IAAI,kBAAkB,CAK9B;AAED,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,uBAA4B,GAAG,kBAAkB,EAAE,CAczF;AAED;;;oDAGoD;AACpD,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,SAAS,cAAc,EAAE,EACnC,IAAI,EAAE,uBAAuB,GAAG;IAC9B,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAChD;wCACoC;IACpC,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B,GACA;IACD,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,YAAY,EAAE,cAAc,CAAC,cAAc,CAAC,CAAC,cAAc,CAAC,CAAA;KAAE,CAAC,CAAC;IAClG,mBAAmB,EAAE,MAAM,CACzB,MAAM,EACN;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CACvE,CAAC;CACH,CAoCA"}

package/dist/core/harnesses/attestation.js

@@ -15,11 +15,17 @@ import { mkdirSync, readdirSync, readFileSync, renameSync, unlinkSync, writeFile
 import { resolve } from "node:path";
 import { monorepoRoot } from "../agents/coord-client.js";
 import { stableDigest } from "../workflow/durable-record.js";
-export const ATTESTATION_SCHEMA_VERSION = 1;
+export const ATTESTATION_SCHEMA_VERSION = 2;
 /** Dimensions one minimal live turn can honestly establish. Everything else
  * needs a purpose-built scenario and stays outside the record rather than
  * being guessed at. */
-export const ATTESTABLE_DIMENSIONS = ["invocation", "finalResult", "sessionId", "cost"];
+export const ATTESTABLE_DIMENSIONS = [
+    "invocation",
+    "finalResult",
+    "sessionId",
+    "cost",
+    "filesystemPolicyProjection",
+];
 export function attestationsDir(opts = {}) {
     const root = opts.coordRoot ?? monorepoRoot();
     if (!root)
@@ -114,11 +120,13 @@ export function validateAttestation(value, harness) {
 }
 /** An attestation speaks only for the vendor version and declaration it was
  * recorded against. */
-export function isAttestationCurrent(record, binaryVersion, profile) {
+export function isAttestationCurrent(record, binaryVersion, profile, subscriptionOnly) {
     if (!record || !binaryVersion)
         return false;
     if (record.binary_version !== binaryVersion)
         return false;
+    if (subscriptionOnly !== undefined && record.subscription_only !== subscriptionOnly)
+        return false;
     return record.profile_digest === profileDigest(profile);
 }
 export function listAttestations(opts = {}) {
@@ -156,8 +164,9 @@ export function harnessProofInputs(profiles, opts) {
             // No coord root or unreadable store: run unattested rather than fail.
             continue;
         }
-        if (!isAttestationCurrent(record, opts.versionProbe(profile.binary), profile))
+        if (!isAttestationCurrent(record, opts.versionProbe(profile.binary), profile, opts.subscriptionOnly)) {
             continue;
+        }
         harnessAttestations[profile.id] = {
             binary_version: record.binary_version,
             observed_at: record.observed_at,

package/dist/core/harnesses/bench.d.ts

@@ -42,6 +42,9 @@ export interface HarnessBenchOptions {
     coordRoot?: string;
     /** Test seam. Defaults to reading the attestation store. */
     attestationReader?: (harness: HarnessId) => HarnessAttestation | null;
+    /** Only cite attestations recorded under this billing mode. Omitted means
+     * any mode is acceptable for reporting purposes. */
+    subscriptionOnly?: boolean;
 }
 export declare function runHarnessBench(registry: HarnessRegistry, opts?: HarnessBenchOptions): HarnessBenchReport;
 /** Ask an installed vendor CLI what version it is. Null when it is absent or

package/dist/core/harnesses/bench.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bench.d.ts","sourceRoot":"","sources":["../../../src/core/harnesses/bench.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAuB,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEhF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EACV,iBAAiB,EAEjB,0BAA0B,EAC1B,SAAS,EACV,MAAM,YAAY,CAAC;AAGpB,MAAM,MAAM,YAAY,GACpB,WAAW,GACX,SAAS,GACT,aAAa,GACb,gBAAgB,GAChB,SAAS,GACT,SAAS,GACT,OAAO,CAAC;AAEZ,MAAM,MAAM,cAAc,GAAG,cAAc,GAAG,QAAQ,GAAG,UAAU,GAAG,0BAA0B,CAAC;AAEjG;;;;;;wEAMwE;AACxE,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,CAAC;AAE7D,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,SAAS,CAAC;IACnB,SAAS,EAAE,cAAc,CAAC;IAC1B,QAAQ,EAAE,iBAAiB,GAAG,gBAAgB,CAAC;IAC/C,QAAQ,EAAE,YAAY,CAAC;IACvB,OAAO,EAAE,YAAY,CAAC;IACtB,KAAK,EAAE,UAAU,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,EAAE,SAAS,EAAE,CAAC;IACvB,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACtC;sDACkD;IAClD,YAAY,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACzC,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,UAAU,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACnD,4EAA4E;IAC5E,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACjD;qDACiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,SAAS,KAAK,kBAAkB,GAAG,IAAI,CAAC;CACvE;AAgDD,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,eAAe,EACzB,IAAI,GAAE,mBAAwB,GAC7B,kBAAkB,CAwEpB;AA2KD;;kDAEkD;AAClD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIhE"}
+{"version":3,"file":"bench.d.ts","sourceRoot":"","sources":["../../../src/core/harnesses/bench.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAuB,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEhF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EACV,iBAAiB,EAEjB,0BAA0B,EAC1B,SAAS,EACV,MAAM,YAAY,CAAC;AAGpB,MAAM,MAAM,YAAY,GACpB,WAAW,GACX,SAAS,GACT,aAAa,GACb,gBAAgB,GAChB,SAAS,GACT,SAAS,GACT,OAAO,CAAC;AAEZ,MAAM,MAAM,cAAc,GAAG,cAAc,GAAG,QAAQ,GAAG,UAAU,GAAG,0BAA0B,CAAC;AAEjG;;;;;;wEAMwE;AACxE,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,CAAC;AAE7D,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,SAAS,CAAC;IACnB,SAAS,EAAE,cAAc,CAAC;IAC1B,QAAQ,EAAE,iBAAiB,GAAG,gBAAgB,CAAC;IAC/C,QAAQ,EAAE,YAAY,CAAC;IACvB,OAAO,EAAE,YAAY,CAAC;IACtB,KAAK,EAAE,UAAU,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,EAAE,SAAS,EAAE,CAAC;IACvB,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACtC;sDACkD;IAClD,YAAY,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACzC,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,UAAU,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACnD,4EAA4E;IAC5E,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACjD;qDACiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,SAAS,KAAK,kBAAkB,GAAG,IAAI,CAAC;IACtE;wDACoD;IACpD,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAkDD,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,eAAe,EACzB,IAAI,GAAE,mBAAwB,GAC7B,kBAAkB,CAwEpB;AA2LD;;kDAEkD;AAClD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIhE"}

package/dist/core/harnesses/bench.js

@@ -30,7 +30,9 @@ function loadAttestation(id, version, adapter, opts) {
         // No coord root, unreadable store: the bench still runs, just unattested.
         return null;
     }
-    return isAttestationCurrent(record, version, adapter.profile) ? record : null;
+    return isAttestationCurrent(record, version, adapter.profile, opts.subscriptionOnly)
+        ? record
+        : null;
 }
 /** First version-shaped token in a string, or null when there is none.
  * Tolerates the vendor prefixes and suffixes real CLIs print, so
@@ -184,6 +186,18 @@ function observeAdapter(adapter) {
     catch {
         planningFailed = true;
     }
+    // Plan a second invocation carrying a filesystem policy. Offline this can only
+    // show whether the adapter *renders* the projection, never whether the vendor
+    // enforces it; enforcement needs the live probe (ADR 0041). An adapter that
+    // declares no projection throws here, which is the correct rendering.
+    let projectionRendered = false;
+    try {
+        const projected = adapter.buildInvocation({ ...request, filesystemPolicy: { mode: "read-only" } }, "/harnery-bench/final.txt").argv;
+        projectionRendered = projected.join(" ") !== argv.join(" ");
+    }
+    catch {
+        projectionRendered = false;
+    }
     let normalized = null;
     try {
         normalized = adapter.normalizeResult(adapter.fixture.raw);
@@ -219,6 +233,7 @@ function observeAdapter(adapter) {
             : costObserved),
         toolEvidence: fromAdapter(normalized && "toolEvidence" in normalized ? "supported" : "unsupported"),
         policyMapping: NOT_CHECKED,
+        filesystemPolicyProjection: fromAdapter(projectionRendered ? "supported" : "unsupported"),
         interruption: NOT_CHECKED,
         streaming: NOT_CHECKED,
         steering: NOT_CHECKED,

package/dist/core/harnesses/profiles.d.ts

@@ -14,8 +14,8 @@ export declare const BUILTIN_HARNESS_PROFILES: {
         readonly modelFamily: "claude";
         readonly effortValues: readonly ["low", "medium", "high", "xhigh", "max"];
         readonly verified: {
-            readonly date: "2026-07-20";
-            readonly version: "current CLI contract";
+            readonly date: "2026-07-25";
+            readonly version: "2.1.197 (Claude Code)";
         };
         readonly capabilities: HarnessCapabilities;
     };
@@ -31,8 +31,15 @@ export declare const BUILTIN_HARNESS_PROFILES: {
         readonly modelFamily: "gpt";
         readonly effortValues: readonly ["none", "minimal", "low", "medium", "high", "xhigh"];
         readonly verified: {
-            readonly date: "2026-07-21";
-            readonly version: "codex-cli 0.145.0-alpha.18";
+            readonly date: "2026-07-25";
+            readonly version: "codex-cli 0.144.5";
+        };
+        readonly sandboxProjection: {
+            readonly modes: {
+                readonly "read-only": "read-only";
+                readonly "workspace-write": "workspace-write";
+            };
+            readonly writableRoots: true;
         };
         readonly capabilities: HarnessCapabilities;
     };
@@ -48,8 +55,8 @@ export declare const BUILTIN_HARNESS_PROFILES: {
         readonly modelFamily: "multi";
         readonly effortValues: readonly [];
         readonly verified: {
-            readonly date: "2026-07-21";
-            readonly version: "2026.07.16-899851b";
+            readonly date: "2026-07-25";
+            readonly version: "2026.07.23-e383d2b";
         };
         readonly capabilities: HarnessCapabilities;
     };

package/dist/core/harnesses/profiles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"profiles.d.ts","sourceRoot":"","sources":["../../../src/core/harnesses/profiles.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAmB,mBAAmB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AA+BvF;gFACgF;AAChF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiFc,CAAC;AAEpD,MAAM,MAAM,gBAAgB,GAAG,MAAM,OAAO,wBAAwB,CAAC;AAErE,eAAO,MAAM,mBAAmB,iDAE/B,CAAC;AAEF,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,EAAE,IAAI,gBAAgB,CAEnE;AAED,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAE5E;AAED,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAUlF"}
+{"version":3,"file":"profiles.d.ts","sourceRoot":"","sources":["../../../src/core/harnesses/profiles.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAmB,mBAAmB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAgCvF;gFACgF;AAChF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2Fc,CAAC;AAEpD,MAAM,MAAM,gBAAgB,GAAG,MAAM,OAAO,wBAAwB,CAAC;AAErE,eAAO,MAAM,mBAAmB,iDAE/B,CAAC;AAEF,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,EAAE,IAAI,gBAAgB,CAEnE;AAED,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAE5E;AAED,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAUlF"}