harnery 0.26.0 → 0.28.0

package/dist/commands/browse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"browse.d.ts","sourceRoot":"","sources":["../../src/commands/browse.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAgJ1E,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,WAAW,EACtB,OAAO,CAAC,EAAE,qBAAqB,GAC9B,IAAI,CA6PN"}
+{"version":3,"file":"browse.d.ts","sourceRoot":"","sources":["../../src/commands/browse.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAiJ1E,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,WAAW,EACtB,OAAO,CAAC,EAAE,qBAAqB,GAC9B,IAAI,CAiQN"}

package/dist/commands/browse.js

@@ -55,6 +55,7 @@ export function registerBrowseCommand(program, emitParam, context) {
         .option("--press <key>", "Press a key after navigation/fill (e.g., Enter)")
         .option("--wait-for <selector>", "Wait for this selector before capturing output")
         .option("--evaluate <js>", "Run JS in the page context after navigation; result printed to stdout")
+        .option("--capture-evaluate <js>", "In trio mode, evaluate JS inside the exact screenshot viewport immediately before capture; result is written as captureEval")
         .option("--batch <steps>", "Run multiple steps in one session, semicolon-separated. Each step is one of: " +
         "`click <selector>`, `fill <selector=>value>`, `press <key>`, `wait <selector|ms>`, `eval <js>`, `reload`. " +
         'Example: `--batch "click button; wait 1500; reload; wait 3000"`. `reload` preserves sessionStorage + cookies, which is how to repro sessionStorage-restored UI state.')
@@ -312,6 +313,9 @@ async function runBrowse(url, opts, context) {
             devOverlay = await captureDevOverlay(browser.currentPage);
         }
         if (printMode) {
+            if (opts.captureEvaluate) {
+                throw new Error("--capture-evaluate requires trio mode so its result can be bound to a screenshot.");
+            }
             if (opts.baseline || opts.diff) {
                 throw new Error("--baseline / --diff require trio mode (screenshot file). Remove --snapshot/--html/--json or capture the screenshot first.");
             }
@@ -551,11 +555,28 @@ async function runTrioMode(browser, navResult, opts, evalResult, visibility, wid
     const skipScreenshot = opts.screenshot === false || opts.domOnly === true;
     let pngPath;
     let pngBytes;
+    let captureEvalResult;
+    let captureViewport;
+    let captureEvidence;
     if (!skipScreenshot) {
         pngPath = `${prefix}.png`;
-        pngBytes = await browser.screenshot(pngPath, { fullPage: opts.fullPage !== false });
+        if (opts.captureEvaluate) {
+            const captured = await browser.screenshotWithEvaluation(pngPath, opts.captureEvaluate, {
+                fullPage: opts.fullPage !== false,
+            });
+            pngBytes = captured.bytes;
+            captureEvalResult = captured.evaluation;
+            captureViewport = captured.viewport;
+            captureEvidence = captured.evidence;
+        }
+        else {
+            pngBytes = await browser.screenshot(pngPath, { fullPage: opts.fullPage !== false });
+        }
         written.push(pngPath);
     }
+    else if (opts.captureEvaluate) {
+        throw new Error("--capture-evaluate requires a screenshot; remove --no-screenshot / --dom-only.");
+    }
     const htmlPath = `${prefix}.html`;
     const html = await browser.htmlContent(opts.selector);
     writeFileSync(htmlPath, html);
@@ -577,6 +598,11 @@ async function runTrioMode(browser, navResult, opts, evalResult, visibility, wid
         envelope.screenshotBytes = pngBytes;
     if (opts.evaluate)
         envelope.eval = evalResult;
+    if (opts.captureEvaluate) {
+        envelope.captureEval = captureEvalResult;
+        envelope.captureViewport = captureViewport;
+        envelope.captureEvidence = captureEvidence;
+    }
     if (opts.networkHar)
         envelope.har = resolve(opts.networkHar);
     if (visibility)

package/dist/commands/harness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"harness.d.ts","sourceRoot":"","sources":["../../src/commands/harness.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EACL,KAAK,WAAW,EAEhB,KAAK,wBAAwB,EAC7B,KAAK,kBAAkB,EAIxB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAkBjE,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAuJhF;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,CAgBhF;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,GAAG,MAAM,CAU9E;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAkB7D;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CA6BpE;AAgBD,mFAAmF;AACnF,YAAY,EAAE,WAAW,EAAE,CAAC"}
+{"version":3,"file":"harness.d.ts","sourceRoot":"","sources":["../../src/commands/harness.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EACL,KAAK,WAAW,EAEhB,KAAK,wBAAwB,EAC7B,KAAK,kBAAkB,EAIxB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAmBjE,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CA4JhF;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,CAgBhF;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,GAAG,MAAM,CAU9E;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAkB7D;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CA6BpE;AAgBD,mFAAmF;AACnF,YAAY,EAAE,WAAW,EAAE,CAAC"}

package/dist/commands/harness.js

@@ -69,6 +69,7 @@ export function registerHarnessCommand(program, emit) {
         .option("--yes", "Confirm that this spends real vendor tokens")
         .option("--subscription-only", "Scrub API-key vars so the child uses its stored login (repo default via config.jsonc workflow.subscriptionOnly)")
         .option("--timeout <ms>", "Per-harness probe timeout in milliseconds")
+        .option("--projection", "Also probe whether a declared sandbox is enforced; costs two extra turns per capable harness")
         .option("--json", "Machine-readable attestation report")
         .action(async (harnesses, opts) => {
         if (!opts.yes) {
@@ -94,6 +95,7 @@ export function registerHarnessCommand(program, emit) {
                 harnesses,
                 timeoutMs,
                 subscriptionOnly,
+                projection: opts.projection === true,
             });
             if (opts.json) {
                 emit.config({ format: "json" });

package/dist/commands/work.d.ts

@@ -1,4 +1,6 @@
 import type { Command } from "commander";
 import type { EmitContext } from "../commander.js";
+import { type WorkAttempt } from "../core/work/index.js";
 export declare function registerWorkCommand(program: Command, emit: EmitContext): void;
+export declare function renderAttemptRow(attempt: WorkAttempt): string;
 //# sourceMappingURL=work.d.ts.map

package/dist/commands/work.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"work.d.ts","sourceRoot":"","sources":["../../src/commands/work.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAuDnD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CA8F7E"}
+{"version":3,"file":"work.d.ts","sourceRoot":"","sources":["../../src/commands/work.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAUnD,OAAO,EAUL,KAAK,WAAW,EAEjB,MAAM,uBAAuB,CAAC;AAsC/B,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CA8F7E;AAgND,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAM7D"}

package/dist/commands/work.js

@@ -4,6 +4,7 @@ import { findCoordRoot } from "../core/hooks/resolve/coord-root.js";
 import { loadPolicyFile } from "../core/policy/index.js";
 import { acceptWorkItem, cancelWorkItem, createWorkItem, listWorkItems, readWorkItem, reconcileAllWorkItems, reconcileWorkItem, reopenWorkItem, runWorkItem, } from "../core/work/index.js";
 import { WorkflowParkedError } from "../core/workflow/index.js";
+const MAX_ATTEMPT_JOURNAL_ERROR_RENDER = 240;
 export function registerWorkCommand(program, emit) {
     const registry = createBuiltinHarnessRegistry();
     const harnesses = registry.ids();
@@ -182,14 +183,43 @@ function registerGovernanceCommand(work, name, emit) {
             : "Explicitly reopen terminal or blocked work for a future attempt.")
         .option("--actor <name>", "Actor recorded in the governance receipt")
         .option("--reason <text>", "Bounded decision reason")
-        .option("--json", "Emit the complete work record as JSON")
-        .action((workId, opts) => {
+        .option("--json", "Emit the complete work record as JSON");
+    const command = work.commands.at(-1);
+    if (name === "reopen") {
+        command.option("--finding <text>", "Correction the next attempt must address (repeatable)", collectValue, []);
+    }
+    if (name === "accept") {
+        command.option("--dispose <id=outcome[:reason]>", "Dispose of an open finding: fixed, or deferred:<reason> (repeatable)", collectValue, []);
+    }
+    command.action((workId, opts) => {
         withWorkRoot(emit, (coordRoot) => {
             const fn = name === "accept" ? acceptWorkItem : name === "cancel" ? cancelWorkItem : reopenWorkItem;
-            emitWork(fn(coordRoot, workId, opts), opts.json, emit, true);
+            emitWork(fn(coordRoot, workId, {
+                ...opts,
+                ...(opts.finding?.length ? { findings: opts.finding } : {}),
+                ...(opts.dispose?.length ? { dispositions: opts.dispose.map(parseDisposition) } : {}),
+            }), opts.json, emit, true);
         });
     });
 }
+function collectValue(value, previous) {
+    return [...previous, value];
+}
+/** `<id>=fixed` or `<id>=deferred:<reason>`. Deferring without a reason is
+ * rejected downstream, so a lapsed finding cannot look like a decision. */
+function parseDisposition(input) {
+    const split = input.indexOf("=");
+    if (split <= 0)
+        throw new Error(`invalid --dispose ${JSON.stringify(input)}; expected <id>=<outcome>`);
+    const id = input.slice(0, split).trim();
+    const rest = input.slice(split + 1).trim();
+    const [outcome, ...reasonParts] = rest.split(":");
+    if (outcome !== "fixed" && outcome !== "deferred") {
+        throw new Error(`invalid --dispose outcome ${JSON.stringify(outcome)}; expected fixed or deferred`);
+    }
+    const reason = reasonParts.join(":").trim();
+    return { id, outcome, ...(reason ? { reason } : {}) };
+}
 function emitWork(record, json, emit, detail = false) {
     if (json) {
         emit.config({ format: "json" });
@@ -215,7 +245,7 @@ function emitWork(record, json, emit, detail = false) {
         lines.push("acceptance:", ...record.intent.acceptance.map((item) => `  - ${item}`));
     }
     if (projection.attempts.length) {
-        lines.push("attempts:", ...projection.attempts.map((attempt) => `  ${attempt.number}. ${attempt.run_id}  ${attempt.status}`));
+        lines.push("attempts:", ...projection.attempts.map(renderAttemptRow));
     }
     if (projection.approval_id)
         lines.push(`approval: ${projection.approval_id}`);
@@ -223,6 +253,19 @@ function emitWork(record, json, emit, detail = false) {
         lines.push(`proof: ${projection.proof_path}`);
     emit.text(`${lines.join("\n")}\n`);
 }
+export function renderAttemptRow(attempt) {
+    const statusDetail = attempt.status === "journal_unreadable"
+        ? `: ${renderAttemptJournalError(attempt.journal_error)}`
+        : "";
+    return `  ${attempt.number}. ${attempt.run_id}  ${attempt.status}${statusDetail}`;
+}
+function renderAttemptJournalError(error) {
+    const normalized = (error ?? "").replace(/\s+/g, " ").trim();
+    const value = normalized || "unknown journal read error";
+    if (value.length <= MAX_ATTEMPT_JOURNAL_ERROR_RENDER)
+        return value;
+    return `${value.slice(0, MAX_ATTEMPT_JOURNAL_ERROR_RENDER - 3).trimEnd()}...`;
+}
 function renderWorkRow(record) {
     const projection = record.projection;
     return `${record.intent.id}  ${projection.state.padEnd(17)}  ${projection.attempts_used}/${record.intent.max_attempts}  ${projection.next_action.padEnd(21)}  ${record.intent.title}`;

package/dist/commands/workflow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../../src/commands/workflow.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAqEnD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CA6pBjF"}
+{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../../src/commands/workflow.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAyEnD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAmuBjF"}

package/dist/commands/workflow.js

@@ -459,6 +459,70 @@ export function registerWorkflowCommand(program, emit) {
             process.exit(1);
         }
     });
+    workflow
+        .command("reclaim <run-id>")
+        .description("Resolve a workspace preserved because it was dirty: salvage the work to its branch, then release.")
+        .option("--yes", "Confirm that this commits or discards uncommitted work, then releases")
+        .option("--discard", "Throw the uncommitted work away instead of salvaging it")
+        .option("--json", "Emit the reclaim preparation and cleanup result as JSON")
+        .action(async (runId, opts) => {
+        const coordRoot = findCoordRoot();
+        if (!coordRoot) {
+            emit.error({
+                code: "no_coord_root",
+                message: "no .harnery/ coordination root found; run `init` first",
+            });
+            process.exit(1);
+        }
+        if (!opts.yes) {
+            emit.error({
+                code: "reclaim_confirmation_required",
+                message: opts.discard
+                    ? "reclaim --discard permanently destroys uncommitted work; pass --yes to confirm"
+                    : "workspace reclaim commits uncommitted work to its branch and then releases the worktree; pass --yes to confirm",
+            });
+            process.exit(1);
+        }
+        try {
+            const { inspectWorkflowWorkspace, prepareReclaim, cleanupWorkspace } = await import("../core/workflow/index.js");
+            const inspection = inspectWorkflowWorkspace(coordRoot, runId);
+            if (!inspection.ok) {
+                emit.error({ code: "workflow_reclaim_failed", message: inspection.error });
+                process.exit(1);
+            }
+            const allocation = inspection.value.allocation;
+            if (!allocation) {
+                emit.error({
+                    code: "workflow_reclaim_unavailable",
+                    message: `run ${runId} has no provider-owned Git workspace to reclaim`,
+                });
+                process.exit(1);
+            }
+            const preparation = prepareReclaim({
+                worktreePath: allocation.active_root,
+                mode: opts.discard ? "discard" : "salvage",
+                runId,
+            });
+            // Cleanup still owns removal. Reclaim only changes whether the tree it
+            // finds is dirty, so there is one audited release path, not two.
+            const provider = await builtInProviderForRun(coordRoot, runId);
+            const cleanup = await cleanupWorkspace({ coordRoot, runId, provider });
+            if (opts.json) {
+                emit.config({ format: "json" });
+                emit.data({ preparation, cleanup });
+                return;
+            }
+            emit.text(`reclaim ${preparation.action}: ${preparation.detail}\n` +
+                `workspace cleanup ${cleanup.status}: ${cleanup.binding_id}\n`);
+        }
+        catch (error) {
+            emit.error({
+                code: "workflow_reclaim_failed",
+                message: error instanceof Error ? error.message : String(error),
+            });
+            process.exit(1);
+        }
+    });
     const approvals = workflow
         .command("approvals")
         .description("Inspect and resolve durable workflow policy approvals.");

package/dist/core/harnesses/attest-projection.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Live probe for the `filesystemPolicyProjection` capability (ADR 0041).
+ *
+ * Every other attested dimension can be read off a single successful turn: the
+ * result either carries a session id or it does not. Projection cannot. A
+ * sandbox that is declared but not enforced looks exactly like a sandbox that is
+ * enforced, because in both cases the CLI accepts the flag and exits zero. The
+ * only way to tell them apart is to give a child something to write and look at
+ * the filesystem afterwards.
+ *
+ * That introduces its own confound. If the treatment child never attempts the
+ * write, the sentinel is absent for a reason that has nothing to do with the
+ * sandbox, and absence would be read as enforcement. So the probe runs a control
+ * first, under a mode that permits the write. Only a control that actually
+ * produced its sentinel licenses any reading of the treatment run; otherwise the
+ * probe reports inconclusive and records nothing, which is the same prerequisite
+ * rule the main attestation applies to a failed turn.
+ */
+import type { SpawnRequest, SpawnResult } from "../workflow/types.js";
+import type { HarnessAdapter } from "./types.js";
+export declare function projectionPrompt(sentinel: string): string;
+export type ProjectionObservation = "supported" | "unsupported" | "inconclusive";
+export interface ProjectionProbeResult {
+    observation: ProjectionObservation;
+    /** Why, in one line, suitable for an attestation note or a report row. */
+    detail: string;
+}
+export interface ProjectionProbeOptions {
+    timeoutMs: number;
+    subscriptionOnly: boolean;
+    /** Test seam. Defaults to the adapter's production spawner. */
+    spawn?: (request: SpawnRequest) => Promise<SpawnResult>;
+    /** Test seam. Defaults to a fresh directory under the OS temp root. */
+    workdir?: string;
+}
+/**
+ * Run the control/treatment pair and report what the filesystem showed.
+ *
+ * Returns `inconclusive` rather than throwing for every expected failure, so a
+ * probe that cannot reach a verdict degrades into "nothing recorded" instead of
+ * failing the whole attestation sweep.
+ */
+export declare function probeFilesystemProjection(adapter: HarnessAdapter, opts: ProjectionProbeOptions): Promise<ProjectionProbeResult>;
+//# sourceMappingURL=attest-projection.d.ts.map

package/dist/core/harnesses/attest-projection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attest-projection.d.ts","sourceRoot":"","sources":["../../../src/core/harnesses/attest-projection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAWjD,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,MAAM,MAAM,qBAAqB,GAAG,WAAW,GAAG,aAAa,GAAG,cAAc,CAAC;AAEjF,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,qBAAqB,CAAC;IACnC,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,+DAA+D;IAC/D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IACxD,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,qBAAqB,CAAC,CAoDhC"}

package/dist/core/harnesses/attest-projection.js

@@ -0,0 +1,113 @@
+/**
+ * Live probe for the `filesystemPolicyProjection` capability (ADR 0041).
+ *
+ * Every other attested dimension can be read off a single successful turn: the
+ * result either carries a session id or it does not. Projection cannot. A
+ * sandbox that is declared but not enforced looks exactly like a sandbox that is
+ * enforced, because in both cases the CLI accepts the flag and exits zero. The
+ * only way to tell them apart is to give a child something to write and look at
+ * the filesystem afterwards.
+ *
+ * That introduces its own confound. If the treatment child never attempts the
+ * write, the sentinel is absent for a reason that has nothing to do with the
+ * sandbox, and absence would be read as enforcement. So the probe runs a control
+ * first, under a mode that permits the write. Only a control that actually
+ * produced its sentinel licenses any reading of the treatment run; otherwise the
+ * probe reports inconclusive and records nothing, which is the same prerequisite
+ * rule the main attestation applies to a failed turn.
+ */
+import { existsSync, mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+/** Distinct names so a control artifact can never be mistaken for a treatment
+ * one, even if a child writes both or the directory is reused. */
+const CONTROL_SENTINEL = "harnery-projection-control.txt";
+const TREATMENT_SENTINEL = "harnery-projection-treatment.txt";
+/** A child needs a few turns to run a shell command and report back; one turn is
+ * not enough to both act and answer. */
+const PROJECTION_MAX_TURNS = 4;
+export function projectionPrompt(sentinel) {
+    return `Create a file named ${sentinel} in the current directory containing the text ok. Then reply with the single word: done`;
+}
+/**
+ * Run the control/treatment pair and report what the filesystem showed.
+ *
+ * Returns `inconclusive` rather than throwing for every expected failure, so a
+ * probe that cannot reach a verdict degrades into "nothing recorded" instead of
+ * failing the whole attestation sweep.
+ */
+export async function probeFilesystemProjection(adapter, opts) {
+    if (!adapter.profile.sandboxProjection) {
+        // Nothing to observe: the adapter refuses a projection before launch, which
+        // is a fact about our own code and is already covered by unit tests. Spending
+        // a vendor turn here would attest nothing.
+        return {
+            observation: "inconclusive",
+            detail: "the adapter declares no sandbox projection, so there is nothing to observe live",
+        };
+    }
+    const spawn = opts.spawn ?? ((request) => adapter.spawn(request));
+    const ownsWorkdir = !opts.workdir;
+    const workdir = opts.workdir ?? mkdtempSync(join(tmpdir(), "harnery-projection-"));
+    try {
+        const control = await runTurn(spawn, workdir, CONTROL_SENTINEL, "workspace-write", opts);
+        if (!control.ok) {
+            return {
+                observation: "inconclusive",
+                detail: `the control turn did not complete (${control.detail})`,
+            };
+        }
+        if (!existsSync(join(workdir, CONTROL_SENTINEL))) {
+            return {
+                observation: "inconclusive",
+                detail: "the control child did not create its file even though writing was permitted, so an absent treatment file would prove nothing",
+            };
+        }
+        const treatment = await runTurn(spawn, workdir, TREATMENT_SENTINEL, "read-only", opts);
+        // A read-only child may well fail its turn: refusing the write is the point.
+        // So unlike the control, a failed treatment turn is still evidence, and only
+        // the filesystem decides.
+        const wrote = existsSync(join(workdir, TREATMENT_SENTINEL));
+        if (wrote) {
+            return {
+                observation: "unsupported",
+                detail: "the child wrote under a read-only projection, so the declared mode is not enforced",
+            };
+        }
+        return {
+            observation: "supported",
+            detail: `a read-only projection blocked a write the same child performed when permitted${treatment.ok ? "" : ` (treatment turn also reported: ${treatment.detail})`}`,
+        };
+    }
+    finally {
+        if (ownsWorkdir)
+            rmSync(workdir, { recursive: true, force: true });
+    }
+}
+async function runTurn(spawn, cwd, sentinel, mode, opts) {
+    try {
+        const result = await spawn({
+            prompt: projectionPrompt(sentinel),
+            timeoutMs: opts.timeoutMs,
+            maxTurns: PROJECTION_MAX_TURNS,
+            cwd,
+            subscriptionOnly: opts.subscriptionOnly,
+            filesystemPolicy: { mode },
+        });
+        return { ok: result.ok, detail: result.ok ? "completed" : boundedDetail(result.error) };
+    }
+    catch (error) {
+        return { ok: false, detail: boundedDetail(error.message) };
+    }
+}
+const MAX_DETAIL_CHARS = 160;
+/** Same tail-preserving rule as the main probe: a CLI prints its banner first
+ * and the reason it failed last. */
+function boundedDetail(reason) {
+    if (!reason)
+        return "no error reported";
+    const collapsed = reason.replace(/\s+/g, " ").trim();
+    if (!collapsed)
+        return "no error reported";
+    return collapsed.length > MAX_DETAIL_CHARS ? `…${collapsed.slice(-MAX_DETAIL_CHARS)}` : collapsed;
+}

package/dist/core/harnesses/attest.d.ts

@@ -6,6 +6,7 @@
  * parallel test rig.
  */
 import type { SpawnResult } from "../workflow/types.js";
+import { probeFilesystemProjection } from "./attest-projection.js";
 import type { AttestableDimension, HarnessAttestation } from "./attestation.js";
 import type { HarnessRegistry } from "./registry.js";
 import type { CapabilitySupport, HarnessId } from "./types.js";
@@ -47,6 +48,14 @@ export interface RunHarnessAttestationOptions {
     spawn?: (harness: HarnessId, prompt: string, timeoutMs: number) => Promise<SpawnResult>;
     /** Test seam. Defaults to writing under the coord root. */
     persist?: (record: HarnessAttestation) => void;
+    /**
+     * Also probe `filesystemPolicyProjection` (ADR 0041). Off by default because
+     * it costs two extra turns per capable harness, against one for everything
+     * else: the observation needs a control run to be readable at all.
+     */
+    projection?: boolean;
+    /** Test seam for the projection probe. */
+    probeProjection?: typeof probeFilesystemProjection;
     now?: () => Date;
 }
 export declare function runHarnessAttestation(registry: HarnessRegistry, opts?: RunHarnessAttestationOptions): Promise<HarnessAttestationReport>;

package/dist/core/harnesses/attest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"attest.d.ts","sourceRoot":"","sources":["../../../src/core/harnesses/attest.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,KAAK,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAQhF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE/D;+CAC+C;AAC/C,eAAO,MAAM,kBAAkB,mCAAmC,CAAC;AAEnE,eAAO,MAAM,8BAA8B,SAAU,CAAC;AAqBtD,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,SAAS,GAAG,aAAa,GAAG,QAAQ,CAAC;AAEnF,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,SAAS,CAAC;IACnB,OAAO,EAAE,kBAAkB,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,SAAS,EAAE,CAAC;IACvB,OAAO,EAAE,wBAAwB,EAAE,CAAC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB;8DAC0D;IAC1D,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,4BAA4B;IAC3C,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;mDAG+C;IAC/C,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,4EAA4E;IAC5E,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACjD,+DAA+D;IAC/D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IACxF,2DAA2D;IAC3D,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,IAAI,CAAC;IAC/C,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,eAAe,EACzB,IAAI,GAAE,4BAAiC,GACtC,OAAO,CAAC,wBAAwB,CAAC,CA4FnC"}
+{"version":3,"file":"attest.d.ts","sourceRoot":"","sources":["../../../src/core/harnesses/attest.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,KAAK,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAQhF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE/D;+CAC+C;AAC/C,eAAO,MAAM,kBAAkB,mCAAmC,CAAC;AAEnE,eAAO,MAAM,8BAA8B,SAAU,CAAC;AAqBtD,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,SAAS,GAAG,aAAa,GAAG,QAAQ,CAAC;AAEnF,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,SAAS,CAAC;IACnB,OAAO,EAAE,kBAAkB,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,SAAS,EAAE,CAAC;IACvB,OAAO,EAAE,wBAAwB,EAAE,CAAC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB;8DAC0D;IAC1D,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,4BAA4B;IAC3C,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;mDAG+C;IAC/C,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,4EAA4E;IAC5E,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACjD,+DAA+D;IAC/D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IACxF,2DAA2D;IAC3D,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,IAAI,CAAC;IAC/C;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,0CAA0C;IAC1C,eAAe,CAAC,EAAE,OAAO,yBAAyB,CAAC;IACnD,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,eAAe,EACzB,IAAI,GAAE,4BAAiC,GACtC,OAAO,CAAC,wBAAwB,CAAC,CAyGnC"}

package/dist/core/harnesses/attest.js

@@ -5,6 +5,7 @@
  * uses, so what gets attested is the path production takes rather than a
  * parallel test rig.
  */
+import { probeFilesystemProjection } from "./attest-projection.js";
 import { ATTESTATION_SCHEMA_VERSION, profileDigest, sealAttestation, writeAttestation, } from "./attestation.js";
 import { probeBinaryVersion } from "./bench.js";
 /** Fixed and content-free, so nothing user-supplied can reach the record and
@@ -88,6 +89,18 @@ export async function runHarnessAttestation(registry, opts = {}) {
             sessionId: result.sessionId ? "supported" : "unsupported",
             cost: result.costUsd !== undefined ? "supported" : "unsupported",
         };
+        let projectionNote = "";
+        if (opts.projection) {
+            const probe = opts.probeProjection ?? probeFilesystemProjection;
+            const outcome = await probe(adapter, { timeoutMs, subscriptionOnly });
+            // An inconclusive probe records nothing for the dimension, leaving the
+            // declaration to stand on its own rather than dressing a non-observation
+            // as an observation.
+            if (outcome.observation !== "inconclusive") {
+                observations.filesystemPolicyProjection = outcome.observation;
+            }
+            projectionNote = `; projection ${outcome.observation}: ${outcome.detail}`;
+        }
         const record = sealAttestation({
             schema_version: ATTESTATION_SCHEMA_VERSION,
             harness: id,
@@ -107,7 +120,7 @@ export async function runHarnessAttestation(registry, opts = {}) {
             binaryVersion,
             observations,
             durationMs: result.durationMs,
-            note: `observed on ${binaryVersion}`,
+            note: `observed on ${binaryVersion}${projectionNote}`,
         });
     }
     return {

package/dist/core/harnesses/attestation.d.ts

@@ -16,7 +16,7 @@ export declare const ATTESTATION_SCHEMA_VERSION = 2;
 /** Dimensions one minimal live turn can honestly establish. Everything else
  * needs a purpose-built scenario and stays outside the record rather than
  * being guessed at. */
-export declare const ATTESTABLE_DIMENSIONS: readonly ["invocation", "finalResult", "sessionId", "cost"];
+export declare const ATTESTABLE_DIMENSIONS: readonly ["invocation", "finalResult", "sessionId", "cost", "filesystemPolicyProjection"];
 export type AttestableDimension = (typeof ATTESTABLE_DIMENSIONS)[number];
 export interface HarnessAttestation {
     schema_version: number;

package/dist/core/harnesses/attestation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"attestation.d.ts","sourceRoot":"","sources":["../../../src/core/harnesses/attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAaH,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE/E,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAE5C;;uBAEuB;AACvB,eAAO,MAAM,qBAAqB,6DAA8D,CAAC;AAEjG,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzE,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,SAAS,CAAC;IACnB;kFAC8E;IAC9E,cAAc,EAAE,MAAM,CAAC;IACvB;kDAC8C;IAC9C,cAAc,EAAE,MAAM,CAAC;IACvB;;8DAE0D;IAC1D,iBAAiB,EAAE,OAAO,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB;6DACyD;IACzD,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACtE,kEAAkE;IAClE,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,eAAe,CAAC,IAAI,GAAE,uBAA4B,GAAG,MAAM,CAI1E;AAED;wDACwD;AACxD,wBAAgB,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAM7D;AAMD,wBAAgB,eAAe,CAC7B,MAAM,EAAE,IAAI,CAAC,kBAAkB,EAAE,eAAe,CAAC,GAChD,kBAAkB,CAEpB;AASD;;aAEa;AACb,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,kBAAkB,EAC1B,IAAI,GAAE,uBAA4B,GACjC,MAAM,CAmBR;AAED;;kEAEkE;AAClE,wBAAgB,eAAe,CAC7B,OAAO,EAAE,SAAS,EAClB,IAAI,GAAE,uBAA4B,GACjC,kBAAkB,GAAG,IAAI,CAc3B;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,OAAO,EACd,OAAO,CAAC,EAAE,SAAS,GAClB,kBAAkB,GAAG,IAAI,CAe3B;AAED;uBACuB;AACvB,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,kBAAkB,GAAG,IAAI,EACjC,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,OAAO,EAAE,cAAc,EACvB,gBAAgB,CAAC,EAAE,OAAO,GACzB,MAAM,IAAI,kBAAkB,CAK9B;AAED,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,uBAA4B,GAAG,kBAAkB,EAAE,CAczF;AAED;;;oDAGoD;AACpD,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,SAAS,cAAc,EAAE,EACnC,IAAI,EAAE,uBAAuB,GAAG;IAC9B,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAChD;wCACoC;IACpC,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B,GACA;IACD,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,YAAY,EAAE,cAAc,CAAC,cAAc,CAAC,CAAC,cAAc,CAAC,CAAA;KAAE,CAAC,CAAC;IAClG,mBAAmB,EAAE,MAAM,CACzB,MAAM,EACN;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CACvE,CAAC;CACH,CAoCA"}
+{"version":3,"file":"attestation.d.ts","sourceRoot":"","sources":["../../../src/core/harnesses/attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAaH,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE/E,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAE5C;;uBAEuB;AACvB,eAAO,MAAM,qBAAqB,2FAMxB,CAAC;AAEX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzE,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,SAAS,CAAC;IACnB;kFAC8E;IAC9E,cAAc,EAAE,MAAM,CAAC;IACvB;kDAC8C;IAC9C,cAAc,EAAE,MAAM,CAAC;IACvB;;8DAE0D;IAC1D,iBAAiB,EAAE,OAAO,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB;6DACyD;IACzD,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACtE,kEAAkE;IAClE,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,eAAe,CAAC,IAAI,GAAE,uBAA4B,GAAG,MAAM,CAI1E;AAED;wDACwD;AACxD,wBAAgB,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAM7D;AAMD,wBAAgB,eAAe,CAC7B,MAAM,EAAE,IAAI,CAAC,kBAAkB,EAAE,eAAe,CAAC,GAChD,kBAAkB,CAEpB;AASD;;aAEa;AACb,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,kBAAkB,EAC1B,IAAI,GAAE,uBAA4B,GACjC,MAAM,CAmBR;AAED;;kEAEkE;AAClE,wBAAgB,eAAe,CAC7B,OAAO,EAAE,SAAS,EAClB,IAAI,GAAE,uBAA4B,GACjC,kBAAkB,GAAG,IAAI,CAc3B;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,OAAO,EACd,OAAO,CAAC,EAAE,SAAS,GAClB,kBAAkB,GAAG,IAAI,CAe3B;AAED;uBACuB;AACvB,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,kBAAkB,GAAG,IAAI,EACjC,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,OAAO,EAAE,cAAc,EACvB,gBAAgB,CAAC,EAAE,OAAO,GACzB,MAAM,IAAI,kBAAkB,CAK9B;AAED,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,uBAA4B,GAAG,kBAAkB,EAAE,CAczF;AAED;;;oDAGoD;AACpD,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,SAAS,cAAc,EAAE,EACnC,IAAI,EAAE,uBAAuB,GAAG;IAC9B,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAChD;wCACoC;IACpC,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B,GACA;IACD,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,YAAY,EAAE,cAAc,CAAC,cAAc,CAAC,CAAC,cAAc,CAAC,CAAA;KAAE,CAAC,CAAC;IAClG,mBAAmB,EAAE,MAAM,CACzB,MAAM,EACN;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CACvE,CAAC;CACH,CAoCA"}

package/dist/core/harnesses/attestation.js

@@ -19,7 +19,13 @@ export const ATTESTATION_SCHEMA_VERSION = 2;
 /** Dimensions one minimal live turn can honestly establish. Everything else
  * needs a purpose-built scenario and stays outside the record rather than
  * being guessed at. */
-export const ATTESTABLE_DIMENSIONS = ["invocation", "finalResult", "sessionId", "cost"];
+export const ATTESTABLE_DIMENSIONS = [
+    "invocation",
+    "finalResult",
+    "sessionId",
+    "cost",
+    "filesystemPolicyProjection",
+];
 export function attestationsDir(opts = {}) {
     const root = opts.coordRoot ?? monorepoRoot();
     if (!root)

package/dist/core/harnesses/bench.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bench.d.ts","sourceRoot":"","sources":["../../../src/core/harnesses/bench.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAuB,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEhF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EACV,iBAAiB,EAEjB,0BAA0B,EAC1B,SAAS,EACV,MAAM,YAAY,CAAC;AAGpB,MAAM,MAAM,YAAY,GACpB,WAAW,GACX,SAAS,GACT,aAAa,GACb,gBAAgB,GAChB,SAAS,GACT,SAAS,GACT,OAAO,CAAC;AAEZ,MAAM,MAAM,cAAc,GAAG,cAAc,GAAG,QAAQ,GAAG,UAAU,GAAG,0BAA0B,CAAC;AAEjG;;;;;;wEAMwE;AACxE,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,CAAC;AAE7D,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,SAAS,CAAC;IACnB,SAAS,EAAE,cAAc,CAAC;IAC1B,QAAQ,EAAE,iBAAiB,GAAG,gBAAgB,CAAC;IAC/C,QAAQ,EAAE,YAAY,CAAC;IACvB,OAAO,EAAE,YAAY,CAAC;IACtB,KAAK,EAAE,UAAU,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,EAAE,SAAS,EAAE,CAAC;IACvB,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACtC;sDACkD;IAClD,YAAY,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACzC,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,UAAU,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACnD,4EAA4E;IAC5E,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACjD;qDACiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,SAAS,KAAK,kBAAkB,GAAG,IAAI,CAAC;IACtE;wDACoD;IACpD,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAkDD,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,eAAe,EACzB,IAAI,GAAE,mBAAwB,GAC7B,kBAAkB,CAwEpB;AA2KD;;kDAEkD;AAClD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIhE"}
+{"version":3,"file":"bench.d.ts","sourceRoot":"","sources":["../../../src/core/harnesses/bench.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAuB,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEhF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EACV,iBAAiB,EAEjB,0BAA0B,EAC1B,SAAS,EACV,MAAM,YAAY,CAAC;AAGpB,MAAM,MAAM,YAAY,GACpB,WAAW,GACX,SAAS,GACT,aAAa,GACb,gBAAgB,GAChB,SAAS,GACT,SAAS,GACT,OAAO,CAAC;AAEZ,MAAM,MAAM,cAAc,GAAG,cAAc,GAAG,QAAQ,GAAG,UAAU,GAAG,0BAA0B,CAAC;AAEjG;;;;;;wEAMwE;AACxE,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,CAAC;AAE7D,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,SAAS,CAAC;IACnB,SAAS,EAAE,cAAc,CAAC;IAC1B,QAAQ,EAAE,iBAAiB,GAAG,gBAAgB,CAAC;IAC/C,QAAQ,EAAE,YAAY,CAAC;IACvB,OAAO,EAAE,YAAY,CAAC;IACtB,KAAK,EAAE,UAAU,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,EAAE,SAAS,EAAE,CAAC;IACvB,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACtC;sDACkD;IAClD,YAAY,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACzC,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,UAAU,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACnD,4EAA4E;IAC5E,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACjD;qDACiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,SAAS,KAAK,kBAAkB,GAAG,IAAI,CAAC;IACtE;wDACoD;IACpD,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAkDD,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,eAAe,EACzB,IAAI,GAAE,mBAAwB,GAC7B,kBAAkB,CAwEpB;AA2LD;;kDAEkD;AAClD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIhE"}

package/dist/core/harnesses/bench.js

@@ -186,6 +186,18 @@ function observeAdapter(adapter) {
     catch {
         planningFailed = true;
     }
+    // Plan a second invocation carrying a filesystem policy. Offline this can only
+    // show whether the adapter *renders* the projection, never whether the vendor
+    // enforces it; enforcement needs the live probe (ADR 0041). An adapter that
+    // declares no projection throws here, which is the correct rendering.
+    let projectionRendered = false;
+    try {
+        const projected = adapter.buildInvocation({ ...request, filesystemPolicy: { mode: "read-only" } }, "/harnery-bench/final.txt").argv;
+        projectionRendered = projected.join(" ") !== argv.join(" ");
+    }
+    catch {
+        projectionRendered = false;
+    }
     let normalized = null;
     try {
         normalized = adapter.normalizeResult(adapter.fixture.raw);
@@ -221,6 +233,7 @@ function observeAdapter(adapter) {
             : costObserved),
         toolEvidence: fromAdapter(normalized && "toolEvidence" in normalized ? "supported" : "unsupported"),
         policyMapping: NOT_CHECKED,
+        filesystemPolicyProjection: fromAdapter(projectionRendered ? "supported" : "unsupported"),
         interruption: NOT_CHECKED,
         streaming: NOT_CHECKED,
         steering: NOT_CHECKED,

package/dist/core/harnesses/profiles.d.ts

@@ -34,6 +34,13 @@ export declare const BUILTIN_HARNESS_PROFILES: {
             readonly date: "2026-07-25";
             readonly version: "codex-cli 0.144.5";
         };
+        readonly sandboxProjection: {
+            readonly modes: {
+                readonly "read-only": "read-only";
+                readonly "workspace-write": "workspace-write";
+            };
+            readonly writableRoots: true;
+        };
         readonly capabilities: HarnessCapabilities;
     };
     readonly cursor: {

package/dist/core/harnesses/profiles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"profiles.d.ts","sourceRoot":"","sources":["../../../src/core/harnesses/profiles.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAmB,mBAAmB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AA+BvF;gFACgF;AAChF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiFc,CAAC;AAEpD,MAAM,MAAM,gBAAgB,GAAG,MAAM,OAAO,wBAAwB,CAAC;AAErE,eAAO,MAAM,mBAAmB,iDAE/B,CAAC;AAEF,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,EAAE,IAAI,gBAAgB,CAEnE;AAED,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAE5E;AAED,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAUlF"}
+{"version":3,"file":"profiles.d.ts","sourceRoot":"","sources":["../../../src/core/harnesses/profiles.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAmB,mBAAmB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAgCvF;gFACgF;AAChF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2Fc,CAAC;AAEpD,MAAM,MAAM,gBAAgB,GAAG,MAAM,OAAO,wBAAwB,CAAC;AAErE,eAAO,MAAM,mBAAmB,iDAE/B,CAAC;AAEF,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,EAAE,IAAI,gBAAgB,CAEnE;AAED,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAE5E;AAED,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAUlF"}

package/dist/core/harnesses/profiles.js

@@ -13,6 +13,7 @@ function capabilities(overrides) {
         cost: unsupported(),
         toolEvidence: unsupported("The final-result adapter does not retain tool events."),
         policyMapping: unsupported("No ALLOW/DENY/ASK translation at the workflow boundary."),
+        filesystemPolicyProjection: unsupported("The adapter declares no sandbox projection."),
         interruption: partial("Timeout kills the subprocess; no caller-driven interrupt handle."),
         streaming: unsupported("Workflow children return one normalized final result."),
         steering: unsupported("One prompt is fixed at subprocess launch."),
@@ -62,8 +63,16 @@ export const BUILTIN_HARNESS_PROFILES = {
         modelFamily: "gpt",
         effortValues: ["none", "minimal", "low", "medium", "high", "xhigh"],
         verified: { date: "2026-07-25", version: "codex-cli 0.144.5" },
+        // Verified against codex-cli 0.144.5: `--sandbox <mode>` plus
+        // `sandbox_workspace_write.writable_roots`. Without the writable-root entry
+        // a workspace-write child still cannot write a repository's .git directory.
+        sandboxProjection: {
+            modes: { "read-only": "read-only", "workspace-write": "workspace-write" },
+            writableRoots: true,
+        },
         capabilities: capabilities({
             effortSelection: supported('Mapped to `-c model_reasoning_effort="<level>"`.'),
+            filesystemPolicyProjection: supported("Mode renders to --sandbox; writable roots to sandbox_workspace_write.writable_roots."),
             maxTurns: unsupported("codex exec exposes no turn-ceiling flag."),
             sessionId: unsupported("--output-last-message carries no session id."),
             cost: unsupported("The final-message path carries no usage or cost."),