harnery 0.25.0 → 0.27.0

package/src/commands/harness.ts

@@ -1,5 +1,6 @@
 import type { Command } from "commander";
 import type { EmitContext } from "../commander.ts";
+import { workflowSubscriptionOnly } from "../core/config.ts";
 import {
   type BenchResult,
   createBuiltinHarnessRegistry,
@@ -22,6 +23,8 @@ interface BenchOpts extends FormatOpts {
 interface AttestOpts extends FormatOpts {
   timeout?: string;
   yes?: boolean;
+  subscriptionOnly?: boolean;
+  projection?: boolean;
 }
 
 const registry = createBuiltinHarnessRegistry();
@@ -94,7 +97,15 @@ export function registerHarnessCommand(program: Command, emit: EmitContext): voi
       "Record what the installed vendor CLIs actually do. Runs one real model turn each; needs --yes.",
     )
     .option("--yes", "Confirm that this spends real vendor tokens")
+    .option(
+      "--subscription-only",
+      "Scrub API-key vars so the child uses its stored login (repo default via config.jsonc workflow.subscriptionOnly)",
+    )
     .option("--timeout <ms>", "Per-harness probe timeout in milliseconds")
+    .option(
+      "--projection",
+      "Also probe whether a declared sandbox is enforced; costs two extra turns per capable harness",
+    )
     .option("--json", "Machine-readable attestation report")
     .action(async (harnesses: string[], opts: AttestOpts) => {
       if (!opts.yes) {
@@ -116,7 +127,13 @@ export function registerHarnessCommand(program: Command, emit: EmitContext): voi
         return;
       }
       try {
-        const report = await runHarnessAttestation(registry, { harnesses, timeoutMs });
+        const subscriptionOnly = opts.subscriptionOnly || workflowSubscriptionOnly();
+        const report = await runHarnessAttestation(registry, {
+          harnesses,
+          timeoutMs,
+          subscriptionOnly,
+          projection: opts.projection === true,
+        });
         if (opts.json) {
           emit.config({ format: "json" });
           emit.data(report);
@@ -151,10 +168,11 @@ export function registerHarnessCommand(program: Command, emit: EmitContext): voi
         }
         emit.text(
           renderTable(
-            ["HARNESS", "VERSION", "OBSERVED AT", "OBSERVATIONS"],
+            ["HARNESS", "VERSION", "BILLING", "OBSERVED AT", "OBSERVATIONS"],
             records.map((record) => [
               record.harness,
               record.binary_version,
+              record.subscription_only ? "subscription" : "any",
               record.observed_at,
               Object.entries(record.observations)
                 .map(([dimension, support]) => `${dimension}=${support}`)

package/src/commands/workflow.ts

@@ -70,6 +70,10 @@ interface WorkflowConfirmedMutationOpts {
   json?: boolean;
 }
 
+interface WorkflowReclaimOpts extends WorkflowConfirmedMutationOpts {
+  discard?: boolean;
+}
+
 export function registerWorkflowCommand(program: Command, emit: EmitContext): void {
   const registry = createBuiltinHarnessRegistry();
   const harnesses = registry.ids();
@@ -594,6 +598,76 @@ export function registerWorkflowCommand(program: Command, emit: EmitContext): vo
       }
     });
 
+  workflow
+    .command("reclaim <run-id>")
+    .description(
+      "Resolve a workspace preserved because it was dirty: salvage the work to its branch, then release.",
+    )
+    .option("--yes", "Confirm that this commits or discards uncommitted work, then releases")
+    .option("--discard", "Throw the uncommitted work away instead of salvaging it")
+    .option("--json", "Emit the reclaim preparation and cleanup result as JSON")
+    .action(async (runId: string, opts: WorkflowReclaimOpts) => {
+      const coordRoot = findCoordRoot();
+      if (!coordRoot) {
+        emit.error({
+          code: "no_coord_root",
+          message: "no .harnery/ coordination root found; run `init` first",
+        });
+        process.exit(1);
+      }
+      if (!opts.yes) {
+        emit.error({
+          code: "reclaim_confirmation_required",
+          message: opts.discard
+            ? "reclaim --discard permanently destroys uncommitted work; pass --yes to confirm"
+            : "workspace reclaim commits uncommitted work to its branch and then releases the worktree; pass --yes to confirm",
+        });
+        process.exit(1);
+      }
+      try {
+        const { inspectWorkflowWorkspace, prepareReclaim, cleanupWorkspace } = await import(
+          "../core/workflow/index.ts"
+        );
+        const inspection = inspectWorkflowWorkspace(coordRoot, runId);
+        if (!inspection.ok) {
+          emit.error({ code: "workflow_reclaim_failed", message: inspection.error });
+          process.exit(1);
+        }
+        const allocation = inspection.value.allocation;
+        if (!allocation) {
+          emit.error({
+            code: "workflow_reclaim_unavailable",
+            message: `run ${runId} has no provider-owned Git workspace to reclaim`,
+          });
+          process.exit(1);
+        }
+        const preparation = prepareReclaim({
+          worktreePath: allocation.active_root,
+          mode: opts.discard ? "discard" : "salvage",
+          runId,
+        });
+        // Cleanup still owns removal. Reclaim only changes whether the tree it
+        // finds is dirty, so there is one audited release path, not two.
+        const provider = await builtInProviderForRun(coordRoot, runId);
+        const cleanup = await cleanupWorkspace({ coordRoot, runId, provider });
+        if (opts.json) {
+          emit.config({ format: "json" });
+          emit.data({ preparation, cleanup });
+          return;
+        }
+        emit.text(
+          `reclaim ${preparation.action}: ${preparation.detail}\n` +
+            `workspace cleanup ${cleanup.status}: ${cleanup.binding_id}\n`,
+        );
+      } catch (error) {
+        emit.error({
+          code: "workflow_reclaim_failed",
+          message: error instanceof Error ? error.message : String(error),
+        });
+        process.exit(1);
+      }
+    });
+
   const approvals = workflow
     .command("approvals")
     .description("Inspect and resolve durable workflow policy approvals.");

package/src/core/harnesses/attest-projection.ts

@@ -0,0 +1,151 @@
+/**
+ * Live probe for the `filesystemPolicyProjection` capability (ADR 0041).
+ *
+ * Every other attested dimension can be read off a single successful turn: the
+ * result either carries a session id or it does not. Projection cannot. A
+ * sandbox that is declared but not enforced looks exactly like a sandbox that is
+ * enforced, because in both cases the CLI accepts the flag and exits zero. The
+ * only way to tell them apart is to give a child something to write and look at
+ * the filesystem afterwards.
+ *
+ * That introduces its own confound. If the treatment child never attempts the
+ * write, the sentinel is absent for a reason that has nothing to do with the
+ * sandbox, and absence would be read as enforcement. So the probe runs a control
+ * first, under a mode that permits the write. Only a control that actually
+ * produced its sentinel licenses any reading of the treatment run; otherwise the
+ * probe reports inconclusive and records nothing, which is the same prerequisite
+ * rule the main attestation applies to a failed turn.
+ */
+
+import { existsSync, mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import type { SpawnRequest, SpawnResult } from "../workflow/types.ts";
+import type { HarnessAdapter } from "./types.ts";
+
+/** Distinct names so a control artifact can never be mistaken for a treatment
+ * one, even if a child writes both or the directory is reused. */
+const CONTROL_SENTINEL = "harnery-projection-control.txt";
+const TREATMENT_SENTINEL = "harnery-projection-treatment.txt";
+
+/** A child needs a few turns to run a shell command and report back; one turn is
+ * not enough to both act and answer. */
+const PROJECTION_MAX_TURNS = 4;
+
+export function projectionPrompt(sentinel: string): string {
+  return `Create a file named ${sentinel} in the current directory containing the text ok. Then reply with the single word: done`;
+}
+
+export type ProjectionObservation = "supported" | "unsupported" | "inconclusive";
+
+export interface ProjectionProbeResult {
+  observation: ProjectionObservation;
+  /** Why, in one line, suitable for an attestation note or a report row. */
+  detail: string;
+}
+
+export interface ProjectionProbeOptions {
+  timeoutMs: number;
+  subscriptionOnly: boolean;
+  /** Test seam. Defaults to the adapter's production spawner. */
+  spawn?: (request: SpawnRequest) => Promise<SpawnResult>;
+  /** Test seam. Defaults to a fresh directory under the OS temp root. */
+  workdir?: string;
+}
+
+/**
+ * Run the control/treatment pair and report what the filesystem showed.
+ *
+ * Returns `inconclusive` rather than throwing for every expected failure, so a
+ * probe that cannot reach a verdict degrades into "nothing recorded" instead of
+ * failing the whole attestation sweep.
+ */
+export async function probeFilesystemProjection(
+  adapter: HarnessAdapter,
+  opts: ProjectionProbeOptions,
+): Promise<ProjectionProbeResult> {
+  if (!adapter.profile.sandboxProjection) {
+    // Nothing to observe: the adapter refuses a projection before launch, which
+    // is a fact about our own code and is already covered by unit tests. Spending
+    // a vendor turn here would attest nothing.
+    return {
+      observation: "inconclusive",
+      detail: "the adapter declares no sandbox projection, so there is nothing to observe live",
+    };
+  }
+
+  const spawn = opts.spawn ?? ((request: SpawnRequest) => adapter.spawn(request));
+  const ownsWorkdir = !opts.workdir;
+  const workdir = opts.workdir ?? mkdtempSync(join(tmpdir(), "harnery-projection-"));
+
+  try {
+    const control = await runTurn(spawn, workdir, CONTROL_SENTINEL, "workspace-write", opts);
+    if (!control.ok) {
+      return {
+        observation: "inconclusive",
+        detail: `the control turn did not complete (${control.detail})`,
+      };
+    }
+    if (!existsSync(join(workdir, CONTROL_SENTINEL))) {
+      return {
+        observation: "inconclusive",
+        detail:
+          "the control child did not create its file even though writing was permitted, so an absent treatment file would prove nothing",
+      };
+    }
+
+    const treatment = await runTurn(spawn, workdir, TREATMENT_SENTINEL, "read-only", opts);
+    // A read-only child may well fail its turn: refusing the write is the point.
+    // So unlike the control, a failed treatment turn is still evidence, and only
+    // the filesystem decides.
+    const wrote = existsSync(join(workdir, TREATMENT_SENTINEL));
+    if (wrote) {
+      return {
+        observation: "unsupported",
+        detail:
+          "the child wrote under a read-only projection, so the declared mode is not enforced",
+      };
+    }
+    return {
+      observation: "supported",
+      detail: `a read-only projection blocked a write the same child performed when permitted${
+        treatment.ok ? "" : ` (treatment turn also reported: ${treatment.detail})`
+      }`,
+    };
+  } finally {
+    if (ownsWorkdir) rmSync(workdir, { recursive: true, force: true });
+  }
+}
+
+async function runTurn(
+  spawn: (request: SpawnRequest) => Promise<SpawnResult>,
+  cwd: string,
+  sentinel: string,
+  mode: "read-only" | "workspace-write",
+  opts: ProjectionProbeOptions,
+): Promise<{ ok: boolean; detail: string }> {
+  try {
+    const result = await spawn({
+      prompt: projectionPrompt(sentinel),
+      timeoutMs: opts.timeoutMs,
+      maxTurns: PROJECTION_MAX_TURNS,
+      cwd,
+      subscriptionOnly: opts.subscriptionOnly,
+      filesystemPolicy: { mode },
+    });
+    return { ok: result.ok, detail: result.ok ? "completed" : boundedDetail(result.error) };
+  } catch (error) {
+    return { ok: false, detail: boundedDetail((error as Error).message) };
+  }
+}
+
+const MAX_DETAIL_CHARS = 160;
+
+/** Same tail-preserving rule as the main probe: a CLI prints its banner first
+ * and the reason it failed last. */
+function boundedDetail(reason: string | undefined): string {
+  if (!reason) return "no error reported";
+  const collapsed = reason.replace(/\s+/g, " ").trim();
+  if (!collapsed) return "no error reported";
+  return collapsed.length > MAX_DETAIL_CHARS ? `…${collapsed.slice(-MAX_DETAIL_CHARS)}` : collapsed;
+}

package/src/core/harnesses/attest.ts

@@ -7,8 +7,14 @@
  */
 
 import type { SpawnResult } from "../workflow/types.ts";
+import { probeFilesystemProjection } from "./attest-projection.ts";
 import type { AttestableDimension, HarnessAttestation } from "./attestation.ts";
-import { profileDigest, sealAttestation, writeAttestation } from "./attestation.ts";
+import {
+  ATTESTATION_SCHEMA_VERSION,
+  profileDigest,
+  sealAttestation,
+  writeAttestation,
+} from "./attestation.ts";
 import { probeBinaryVersion } from "./bench.ts";
 import type { HarnessRegistry } from "./registry.ts";
 import type { CapabilitySupport, HarnessId } from "./types.ts";
@@ -24,11 +30,17 @@ export const DEFAULT_ATTESTATION_TIMEOUT_MS = 120_000;
  * short line and the echoed prompt is removed. */
 const MAX_NOTE_REASON_CHARS = 200;
 
+/** Keep the TAIL, not the head. A CLI prints its banner, config, and startup
+ * warnings first and the reason it actually failed last, so truncating from the
+ * front reliably preserves the noise and discards the answer. Learned the hard
+ * way: a head-truncated note once surfaced a cosmetic startup warning while
+ * hiding the real "out of credits" failure on the final line. */
 function boundedReason(reason: string | undefined): string {
   if (!reason) return "no error reported";
   const collapsed = reason.split(ATTESTATION_PROMPT).join("<prompt>").replace(/\s+/g, " ").trim();
+  if (!collapsed) return "no error reported";
   return collapsed.length > MAX_NOTE_REASON_CHARS
-    ? `${collapsed.slice(0, MAX_NOTE_REASON_CHARS)}…`
+    ? `…${collapsed.slice(-MAX_NOTE_REASON_CHARS)}`
     : collapsed;
 }
 
@@ -58,12 +70,25 @@ export interface RunHarnessAttestationOptions {
   timeoutMs?: number;
   cwd?: string;
   coordRoot?: string;
+  /** Scrub API-key vars from the child so it can only use its stored login,
+   * matching `workflow run --subscription-only`. The observation is recorded
+   * against this mode, because a child that may fall back to an API key can
+   * behave differently from one that may not. */
+  subscriptionOnly?: boolean;
   /** Test seam and alternate host probe. A null version means unavailable. */
   versionProbe?: (binary: string) => string | null;
   /** Test seam. Defaults to the adapter's production spawner. */
   spawn?: (harness: HarnessId, prompt: string, timeoutMs: number) => Promise<SpawnResult>;
   /** Test seam. Defaults to writing under the coord root. */
   persist?: (record: HarnessAttestation) => void;
+  /**
+   * Also probe `filesystemPolicyProjection` (ADR 0041). Off by default because
+   * it costs two extra turns per capable harness, against one for everything
+   * else: the observation needs a control run to be readable at all.
+   */
+  projection?: boolean;
+  /** Test seam for the projection probe. */
+  probeProjection?: typeof probeFilesystemProjection;
   now?: () => Date;
 }
 
@@ -74,6 +99,7 @@ export async function runHarnessAttestation(
   const ids = opts.harnesses?.length ? [...opts.harnesses] : registry.ids();
   const timeoutMs = opts.timeoutMs ?? DEFAULT_ATTESTATION_TIMEOUT_MS;
   const cwd = opts.cwd ?? process.cwd();
+  const subscriptionOnly = opts.subscriptionOnly === true;
   const versionProbe = opts.versionProbe ?? probeBinaryVersion;
   const now = opts.now ?? (() => new Date());
   const results: HarnessAttestationResult[] = [];
@@ -99,6 +125,7 @@ export async function runHarnessAttestation(
             timeoutMs,
             maxTurns: 1,
             cwd,
+            subscriptionOnly,
           });
     } catch (error) {
       results.push({
@@ -130,11 +157,25 @@ export async function runHarnessAttestation(
       cost: result.costUsd !== undefined ? "supported" : "unsupported",
     };
 
+    let projectionNote = "";
+    if (opts.projection) {
+      const probe = opts.probeProjection ?? probeFilesystemProjection;
+      const outcome = await probe(adapter, { timeoutMs, subscriptionOnly });
+      // An inconclusive probe records nothing for the dimension, leaving the
+      // declaration to stand on its own rather than dressing a non-observation
+      // as an observation.
+      if (outcome.observation !== "inconclusive") {
+        observations.filesystemPolicyProjection = outcome.observation;
+      }
+      projectionNote = `; projection ${outcome.observation}: ${outcome.detail}`;
+    }
+
     const record = sealAttestation({
-      schema_version: 1,
+      schema_version: ATTESTATION_SCHEMA_VERSION,
       harness: id,
       binary_version: binaryVersion,
       profile_digest: profileDigest(adapter.profile),
+      subscription_only: subscriptionOnly,
       observed_at: now().toISOString(),
       observations,
     });
@@ -148,7 +189,7 @@ export async function runHarnessAttestation(
       binaryVersion,
       observations,
       durationMs: result.durationMs,
-      note: `observed on ${binaryVersion}`,
+      note: `observed on ${binaryVersion}${projectionNote}`,
     });
   }
 

package/src/core/harnesses/attestation.ts

@@ -25,12 +25,18 @@ import { monorepoRoot } from "../agents/coord-client.ts";
 import { stableDigest } from "../workflow/durable-record.ts";
 import type { CapabilitySupport, HarnessId, HarnessProfile } from "./types.ts";
 
-export const ATTESTATION_SCHEMA_VERSION = 1;
+export const ATTESTATION_SCHEMA_VERSION = 2;
 
 /** Dimensions one minimal live turn can honestly establish. Everything else
  * needs a purpose-built scenario and stays outside the record rather than
  * being guessed at. */
-export const ATTESTABLE_DIMENSIONS = ["invocation", "finalResult", "sessionId", "cost"] as const;
+export const ATTESTABLE_DIMENSIONS = [
+  "invocation",
+  "finalResult",
+  "sessionId",
+  "cost",
+  "filesystemPolicyProjection",
+] as const;
 
 export type AttestableDimension = (typeof ATTESTABLE_DIMENSIONS)[number];
 
@@ -43,6 +49,10 @@ export interface HarnessAttestation {
   /** Digest of the capability declaration at record time, so an edited
    * declaration also invalidates the record. */
   profile_digest: string;
+  /** The billing policy the probe ran under. A child launched with API keys
+   * scrubbed can behave differently from one that can fall back to them, so an
+   * observation only speaks for the mode it was made in. */
+  subscription_only: boolean;
   observed_at: string;
   /** Only what the probe actually saw. A dimension absent from this map was
    * not observed, which is not the same as unsupported. */
@@ -164,9 +174,11 @@ export function isAttestationCurrent(
   record: HarnessAttestation | null,
   binaryVersion: string | null,
   profile: HarnessProfile,
+  subscriptionOnly?: boolean,
 ): record is HarnessAttestation {
   if (!record || !binaryVersion) return false;
   if (record.binary_version !== binaryVersion) return false;
+  if (subscriptionOnly !== undefined && record.subscription_only !== subscriptionOnly) return false;
   return record.profile_digest === profileDigest(profile);
 }
 
@@ -194,6 +206,9 @@ export function harnessProofInputs(
   profiles: readonly HarnessProfile[],
   opts: AttestationStoreOptions & {
     versionProbe: (binary: string) => string | null;
+    /** Billing policy this run will use, so a record made under the other mode
+     * is not cited as if it applied. */
+    subscriptionOnly?: boolean;
   },
 ): {
   harnessEvidence: Record<string, { toolEvidence: HarnessProfile["capabilities"]["toolEvidence"] }>;
@@ -220,7 +235,16 @@ export function harnessProofInputs(
       // No coord root or unreadable store: run unattested rather than fail.
       continue;
     }
-    if (!isAttestationCurrent(record, opts.versionProbe(profile.binary), profile)) continue;
+    if (
+      !isAttestationCurrent(
+        record,
+        opts.versionProbe(profile.binary),
+        profile,
+        opts.subscriptionOnly,
+      )
+    ) {
+      continue;
+    }
     harnessAttestations[profile.id] = {
       binary_version: record.binary_version,
       observed_at: record.observed_at,

package/src/core/harnesses/bench.ts

@@ -65,6 +65,9 @@ export interface HarnessBenchOptions {
   coordRoot?: string;
   /** Test seam. Defaults to reading the attestation store. */
   attestationReader?: (harness: HarnessId) => HarnessAttestation | null;
+  /** Only cite attestations recorded under this billing mode. Omitted means
+   * any mode is acceptable for reporting purposes. */
+  subscriptionOnly?: boolean;
 }
 
 const EMPTY_SUMMARY: Record<BenchVerdict, number> = {
@@ -101,7 +104,9 @@ function loadAttestation(
     // No coord root, unreadable store: the bench still runs, just unattested.
     return null;
   }
-  return isAttestationCurrent(record, version, adapter.profile) ? record : null;
+  return isAttestationCurrent(record, version, adapter.profile, opts.subscriptionOnly)
+    ? record
+    : null;
 }
 
 /** First version-shaped token in a string, or null when there is none.
@@ -280,6 +285,21 @@ function observeAdapter(
     planningFailed = true;
   }
 
+  // Plan a second invocation carrying a filesystem policy. Offline this can only
+  // show whether the adapter *renders* the projection, never whether the vendor
+  // enforces it; enforcement needs the live probe (ADR 0041). An adapter that
+  // declares no projection throws here, which is the correct rendering.
+  let projectionRendered = false;
+  try {
+    const projected = adapter.buildInvocation(
+      { ...request, filesystemPolicy: { mode: "read-only" } },
+      "/harnery-bench/final.txt",
+    ).argv;
+    projectionRendered = projected.join(" ") !== argv.join(" ");
+  } catch {
+    projectionRendered = false;
+  }
+
   let normalized: SpawnResult | null = null;
   try {
     normalized = adapter.normalizeResult(adapter.fixture.raw);
@@ -331,6 +351,7 @@ function observeAdapter(
       normalized && "toolEvidence" in normalized ? "supported" : "unsupported",
     ),
     policyMapping: NOT_CHECKED,
+    filesystemPolicyProjection: fromAdapter(projectionRendered ? "supported" : "unsupported"),
     interruption: NOT_CHECKED,
     streaming: NOT_CHECKED,
     steering: NOT_CHECKED,

package/src/core/harnesses/profiles.ts

@@ -16,6 +16,7 @@ function capabilities(overrides: Partial<HarnessCapabilities>): HarnessCapabilit
     cost: unsupported(),
     toolEvidence: unsupported("The final-result adapter does not retain tool events."),
     policyMapping: unsupported("No ALLOW/DENY/ASK translation at the workflow boundary."),
+    filesystemPolicyProjection: unsupported("The adapter declares no sandbox projection."),
     interruption: partial("Timeout kills the subprocess; no caller-driven interrupt handle."),
     streaming: unsupported("Workflow children return one normalized final result."),
     steering: unsupported("One prompt is fixed at subprocess launch."),
@@ -43,7 +44,7 @@ export const BUILTIN_HARNESS_PROFILES = {
     authModel: "own-auth",
     modelFamily: "claude",
     effortValues: ["low", "medium", "high", "xhigh", "max"],
-    verified: { date: "2026-07-20", version: "current CLI contract" },
+    verified: { date: "2026-07-25", version: "2.1.197 (Claude Code)" },
     capabilities: capabilities({
       effortSelection: supported("Mapped to `--effort <level>`."),
       maxTurns: supported("Mapped to `--max-turns <n>`."),
@@ -69,9 +70,19 @@ export const BUILTIN_HARNESS_PROFILES = {
     authModel: "own-auth",
     modelFamily: "gpt",
     effortValues: ["none", "minimal", "low", "medium", "high", "xhigh"],
-    verified: { date: "2026-07-21", version: "codex-cli 0.145.0-alpha.18" },
+    verified: { date: "2026-07-25", version: "codex-cli 0.144.5" },
+    // Verified against codex-cli 0.144.5: `--sandbox <mode>` plus
+    // `sandbox_workspace_write.writable_roots`. Without the writable-root entry
+    // a workspace-write child still cannot write a repository's .git directory.
+    sandboxProjection: {
+      modes: { "read-only": "read-only", "workspace-write": "workspace-write" },
+      writableRoots: true,
+    },
     capabilities: capabilities({
       effortSelection: supported('Mapped to `-c model_reasoning_effort="<level>"`.'),
+      filesystemPolicyProjection: supported(
+        "Mode renders to --sandbox; writable roots to sandbox_workspace_write.writable_roots.",
+      ),
       maxTurns: unsupported("codex exec exposes no turn-ceiling flag."),
       sessionId: unsupported("--output-last-message carries no session id."),
       cost: unsupported("The final-message path carries no usage or cost."),
@@ -95,7 +106,7 @@ export const BUILTIN_HARNESS_PROFILES = {
     authModel: "own-auth",
     modelFamily: "multi",
     effortValues: [],
-    verified: { date: "2026-07-21", version: "2026.07.16-899851b" },
+    verified: { date: "2026-07-25", version: "2026.07.23-e383d2b" },
     capabilities: capabilities({
       effortSelection: unsupported(
         "Cursor embeds effort in some parameterized model ids; Harnery does not rewrite model ids.",

package/src/core/harnesses/types.ts

@@ -16,6 +16,7 @@ export const HARNESS_CAPABILITY_DIMENSIONS = [
   "cost",
   "toolEvidence",
   "policyMapping",
+  "filesystemPolicyProjection",
   "interruption",
   "streaming",
   "steering",
@@ -38,6 +39,17 @@ export interface CapabilityClaim {
 
 export type HarnessCapabilities = Record<HarnessCapabilityDimension, CapabilityClaim>;
 
+/** What one harness can represent of a filesystem-policy projection
+ * (ADR 0039). `null` means the harness does not distinguish that, which is a
+ * fact about the harness rather than something to paper over: a projection the
+ * adapter would silently drop must be refused instead. */
+export interface HarnessSandboxProjection {
+  /** Native representation per canonical mode, or null when unrepresentable. */
+  modes: Record<"read-only" | "workspace-write", string | null>;
+  /** Whether the harness accepts an explicit writable-root set. */
+  writableRoots: boolean;
+}
+
 export interface HarnessProfile {
   id: HarnessId;
   displayName: string;
@@ -52,6 +64,9 @@ export interface HarnessProfile {
   capabilities: HarnessCapabilities;
   /** The last real vendor CLI contract used to validate this declaration. */
   verified?: { date: string; version: string };
+  /** How this adapter projects host filesystem policy into the vendor's own
+   * sandbox (ADR 0039). Absent means it cannot project any of it. */
+  sandboxProjection?: HarnessSandboxProjection;
 }
 
 /** Fully planned child invocation. `resultFile` is used by adapters such as