harnery 0.6.0 → 0.7.0

package/dist/core/agents/rules/claim-conflict.js

@@ -58,10 +58,21 @@ export function evaluateClaim(coordRoot, req) {
     }
     // Ordering check: if we hold any claim with path < req.path, fine.
     // Otherwise the new claim would create a backward-edge in the dependency
-    // graph and risk deadlock. Only applies when there are OTHER fresh peers:
-    // single-agent flow can't deadlock with itself, and the rule otherwise
-    // forces release-and-reacquire cycles on every reverse-order edit pair.
-    const hasFreshPeers = otherPeers.some((p) => isFresh(p.last_heartbeat) && p.files_touched.length > 0);
+    // graph and risk deadlock. Only applies when a fresh peer genuinely CONTENDS
+    // with us — i.e. holds a path that also sits in our own footprint (held
+    // claims ∪ the path we're now requesting). A wait-for cycle is a
+    // strongly-connected set of agents linked by shared files; if no fresh peer
+    // shares any file with our footprint, we're in a disjoint component of the
+    // resource graph and cannot be part of any cycle, so sorted-order acquisition
+    // buys nothing and the block is pure false-positive friction. Sharing a file
+    // is the necessary condition for a cycle through this agent, so this narrowing
+    // leaves the deadlock-prevention invariant intact for genuine contention while
+    // removing the dominant real-world cost — a peer editing unrelated files
+    // walling off every backward-order edit. (Single-agent flow can't deadlock
+    // with itself and never arms, since there are no other peers to contend.)
+    const myFootprint = new Set(myPeer?.files_touched ?? []);
+    myFootprint.add(req.path);
+    const hasContendingPeer = otherPeers.some((p) => isFresh(p.last_heartbeat) && p.files_touched.some((f) => myFootprint.has(f)));
     // Re-editing a path already in our own files_touched acquires no new lock
     // edge, so it can't create a circular wait — the ordering rule must not block
     // it. Without this exemption, an agent that edits a higher-sorting file and
@@ -70,7 +81,7 @@ export function evaluateClaim(coordRoot, req) {
     // both agent-Gibson holding README.md and agent-Ophelia holding AGENTS.md were
     // blocked re-editing those held files after touching a higher path, 2026-07-03).
     const alreadyHeld = myPeer?.files_touched.includes(req.path) ?? false;
-    if (hasFreshPeers && myPeer && myPeer.files_touched.length > 0 && !alreadyHeld) {
+    if (hasContendingPeer && myPeer && myPeer.files_touched.length > 0 && !alreadyHeld) {
         // Only ACTIVE (uncommitted) edits should constrain lock ordering. A claim on
         // a committed-clean file is a finished edit, not a held lock, so it must not
         // wall off a lower-sorted acquisition. Without this, a long session

package/dist/core/config.d.ts

@@ -26,6 +26,16 @@ export declare function stripJsonComments(input: string): string;
  * `coordRoot` is resolved via `findCoordRoot()` when not passed.
  */
 export declare function resolveBinName(coordRoot?: string | null): string;
+/**
+ * The binName explicitly pinned in `<projectRoot>/.harnery/config.jsonc`, or
+ * null when absent. Unlike `resolveBinName()` this ignores `HARNERY_BIN` and
+ * never falls back to the default — it answers "did someone deliberately pin
+ * a name for THIS project?". `init` uses it so a re-run from a different host
+ * CLI can't silently re-stamp its own name over a committed pin (the harnery
+ * repo itself pins `"harn"` while living embedded in a host monorepo whose
+ * CLI would otherwise stamp the host's name into public, committed surfaces).
+ */
+export declare function pinnedBinName(projectRoot: string): string | null;
 /**
  * The host's git-hook (re)install command, for the "commit guard not wired"
  * nudge. Returns the configured `hooksSetupHint` (e.g. "scripts/setup-hooks.sh")

package/dist/core/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/core/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAOH,oFAAoF;AACpF,eAAO,MAAM,gBAAgB,SAAS,CAAC;AAgBvC,8FAA8F;AAC9F,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAqCvD;AAyBD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAShE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAK9E"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/core/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAOH,oFAAoF;AACpF,eAAO,MAAM,gBAAgB,SAAS,CAAC;AAgBvC,8FAA8F;AAC9F,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAqCvD;AAyBD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAShE;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGhE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAK9E"}

package/dist/core/config.js

@@ -106,6 +106,19 @@ export function resolveBinName(coordRoot) {
     }
     return DEFAULT_BIN_NAME;
 }
+/**
+ * The binName explicitly pinned in `<projectRoot>/.harnery/config.jsonc`, or
+ * null when absent. Unlike `resolveBinName()` this ignores `HARNERY_BIN` and
+ * never falls back to the default — it answers "did someone deliberately pin
+ * a name for THIS project?". `init` uses it so a re-run from a different host
+ * CLI can't silently re-stamp its own name over a committed pin (the harnery
+ * repo itself pins `"harn"` while living embedded in a host monorepo whose
+ * CLI would otherwise stamp the host's name into public, committed surfaces).
+ */
+export function pinnedBinName(projectRoot) {
+    const binName = readConfig(projectRoot).binName;
+    return typeof binName === "string" && binName.trim() ? binName.trim() : null;
+}
 /**
  * The host's git-hook (re)install command, for the "commit guard not wired"
  * nudge. Returns the configured `hooksSetupHint` (e.g. "scripts/setup-hooks.sh")

package/dist/core/hooks/cli.js

@@ -26,7 +26,7 @@ import { consumeSince, writeCursor } from "../agents/events/consume.js";
 import { evaluateStopHook } from "../agents/rules/stop-hook.js";
 import { projectHeartbeats } from "../agents/state/heartbeat-projector.js";
 import { shellMutationPaths } from "../agents/state/shell-mutation.js";
-import { captureImages, detectPresence, imageJanitor, playSound, resetSoundCounters, runTurnSummary, scratchArchive, scratchJanitor, scratchRecoveryCue, soundForEvent, syncClaudeSessions, } from "./effects/index.js";
+import { captureImages, detectPresence, imageJanitor, playSound, resetSoundCounters, runSessionSyncExtension, runTurnSummary, scratchArchive, scratchJanitor, scratchRecoveryCue, soundForEvent, } from "./effects/index.js";
 import { emit } from "./events/emit.js";
 import { canonicalize } from "./guard-path.js";
 import { detectHarness } from "./harness/detect.js";
@@ -441,7 +441,7 @@ async function main() {
         // session-telemetry sync (via HARNERY_CLAUDE_SESSIONS_FORCE=1).
         if (harness === "claude-code") {
             scratchArchive(coordRoot, owner.instance_id);
-            syncClaudeSessions(coordRoot, true);
+            runSessionSyncExtension(coordRoot, true);
         }
     }
     // Phase 8: SubagentStart: sync-project to create the subagent heartbeat,
@@ -528,7 +528,7 @@ async function main() {
         // CC effects: rate-limited session-telemetry sync + turn-summary Haiku
         // auto-summary.
         if (harness === "claude-code") {
-            syncClaudeSessions(coordRoot, false);
+            runSessionSyncExtension(coordRoot, false);
             runTurnSummary(coordRoot, owner.instance_id, sessionId, payload?.transcript_path);
         }
         // Master-state heartbeat projection. Drains events.ndjson since the last

package/dist/core/hooks/effects/index.d.ts

@@ -37,14 +37,18 @@ export declare function scratchRecoveryCue(repoRoot: string): string;
 /** Archive the ending agent's scratchpad. Fire-and-forget. */
 export declare function scratchArchive(repoRoot: string, owner: string): void;
 /**
- * Sync Claude Code session JSONL → BigQuery (`harn claude-sessions sync`). Lives
- * in the host CLI (parses Claude Code's own ~/.claude/projects/**\/*.jsonl), so harnery
- * shells out to the harn binary rather than importing it. Detached + unref'd so a
- * slow BigQuery round-trip never blocks the hook. Stop-path syncs are rate-
- * limited inside `harn claude-sessions sync`; SessionEnd forces via env. Caller
- * gates to the claude-code harness.
+ * Fire the optional host session-sync extension on turn stop / session end.
+ * harnery core has no session-telemetry sink of its own; a host that wants one
+ * drops an executable at
+ * `scripts/hooks/harness/claude_code/extensions/session-sync.sh` under the coord
+ * root, and core runs it detached + unref'd so a slow sink never blocks the
+ * hook. `force` arrives as argv $1 ("1" on session end, "0" on turn stop) so the
+ * host can rate-limit the stop path and force-flush on end. No-op when the
+ * script is absent, so a plain public install spawns nothing. Mirrors
+ * `runTurnSummary`'s extension-script pattern. Caller gates to the claude-code
+ * harness.
  */
-export declare function syncClaudeSessions(repoRoot: string, force: boolean): void;
+export declare function runSessionSyncExtension(repoRoot: string, force: boolean): void;
 /**
  * Fire the turn-summary extension (Haiku auto-summary of the turn → heartbeat
  * `turn_summary`). Detached + unref'd; it makes an Anthropic API call and must

package/dist/core/hooks/effects/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/hooks/effects/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AASH,YAAY,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEjE;;;;;;GAMG;AACH,wBAAgB,SAAS,CACvB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,QAAQ,SAAI,GACX,IAAI,CAYN;AAED,mFAAmF;AACnF,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAW3F;AAOD,oFAAoF;AACpF,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAYrD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAa3D;AAED,8DAA8D;AAC9D,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAYpE;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAkBzE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,GAAG,SAAS,GACjC,IAAI,CAqBN;AAED,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAa1D;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAOnD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/hooks/effects/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAQH,YAAY,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEjE;;;;;;GAMG;AACH,wBAAgB,SAAS,CACvB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,QAAQ,SAAI,GACX,IAAI,CAYN;AAED,mFAAmF;AACnF,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAW3F;AAOD,oFAAoF;AACpF,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAYrD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAa3D;AAED,8DAA8D;AAC9D,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAYpE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAqB9E;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,GAAG,SAAS,GACjC,IAAI,CAqBN;AAED,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAa1D;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAOnD"}

package/dist/core/hooks/effects/index.js

@@ -16,7 +16,6 @@ import { existsSync, readdirSync, rmSync } from "node:fs";
 import os from "node:os";
 import { join } from "node:path";
 import { applyDetection } from "../../../lib/presence.js";
-import { resolveBinName } from "../../config.js";
 export { captureImages, imageJanitor } from "./image-capture.js";
 /**
  * Play a notification sound via the cross-platform utility
@@ -111,26 +110,24 @@ export function scratchArchive(repoRoot, owner) {
     }
 }
 /**
- * Sync Claude Code session JSONL → BigQuery (`harn claude-sessions sync`). Lives
- * in the host CLI (parses Claude Code's own ~/.claude/projects/**\/*.jsonl), so harnery
- * shells out to the harn binary rather than importing it. Detached + unref'd so a
- * slow BigQuery round-trip never blocks the hook. Stop-path syncs are rate-
- * limited inside `harn claude-sessions sync`; SessionEnd forces via env. Caller
- * gates to the claude-code harness.
+ * Fire the optional host session-sync extension on turn stop / session end.
+ * harnery core has no session-telemetry sink of its own; a host that wants one
+ * drops an executable at
+ * `scripts/hooks/harness/claude_code/extensions/session-sync.sh` under the coord
+ * root, and core runs it detached + unref'd so a slow sink never blocks the
+ * hook. `force` arrives as argv $1 ("1" on session end, "0" on turn stop) so the
+ * host can rate-limit the stop path and force-flush on end. No-op when the
+ * script is absent, so a plain public install spawns nothing. Mirrors
+ * `runTurnSummary`'s extension-script pattern. Caller gates to the claude-code
+ * harness.
  */
-export function syncClaudeSessions(repoRoot, force) {
+export function runSessionSyncExtension(repoRoot, force) {
     try {
-        const bin = join(repoRoot, "bin", resolveBinName(repoRoot));
-        if (!existsSync(bin))
+        const script = join(repoRoot, "scripts", "hooks", "harness", "claude_code", "extensions", "session-sync.sh");
+        if (!existsSync(script))
             return;
-        const env = {
-            ...process.env,
-            HARNERY_OUTPUT_SESSION_TEE: "0",
-        };
-        if (force)
-            env.HARNERY_CLAUDE_SESSIONS_FORCE = "1";
-        const child = spawn("bash", [bin, "claude-sessions", "sync", "--quiet"], {
-            env,
+        const child = spawn("bash", [script, force ? "1" : "0"], {
+            env: { ...process.env, HARNERY_OUTPUT_SESSION_TEE: "0" },
             detached: true,
             stdio: "ignore",
         });

package/dist/core/hooks/events/emit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"emit.d.ts","sourceRoot":"","sources":["../../../../src/core/hooks/events/emit.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,KAAK,OAAO,EAEZ,KAAK,MAAM,EACZ,MAAM,aAAa,CAAC;AAQrB,MAAM,WAAW,SAAS,CAAC,KAAK,SAAS,SAAS,EAAE,KAAK;IACvD,UAAU,EAAE,KAAK,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,KAAK,CAAC;CACb;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,SAAS,SAAS,EAAE,KAAK,EAC1D,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,GAC7B,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAe7B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,IAAI,CAAC,KAAK,SAAS,SAAS,EAAE,KAAK,EACjD,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,GAC7B,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAqC7B"}
+{"version":3,"file":"emit.d.ts","sourceRoot":"","sources":["../../../../src/core/hooks/events/emit.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,KAAK,OAAO,EAEZ,KAAK,MAAM,EACZ,MAAM,aAAa,CAAC;AAQrB,MAAM,WAAW,SAAS,CAAC,KAAK,SAAS,SAAS,EAAE,KAAK;IACvD,UAAU,EAAE,KAAK,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,KAAK,CAAC;CACb;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,SAAS,SAAS,EAAE,KAAK,EAC1D,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,GAC7B,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAe7B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,IAAI,CAAC,KAAK,SAAS,SAAS,EAAE,KAAK,EACjD,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,GAC7B,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAyC7B"}

package/dist/core/hooks/events/emit.js

@@ -1,5 +1,6 @@
 import { appendFileSync, closeSync, mkdirSync, openSync } from "node:fs";
 import { dirname, join } from "node:path";
+import { maybeRotateEventStream } from "./rotate.js";
 import { SCHEMA_VERSION, } from "./schema.js";
 import { ulid } from "./ulid.js";
 const LOCK_FILE = ".harnery/events.ndjson.lock";
@@ -40,6 +41,9 @@ export function emit(coordRoot, input) {
     const envelope = buildEnvelope(input);
     const streamPath = join(coordRoot, STREAM_FILE);
     const lockPath = join(coordRoot, LOCK_FILE);
+    // Size-triggered rotation: roll the active file to a dated archive when it
+    // crosses the cap, so this append lands in a bounded fresh file. Fail-soft.
+    maybeRotateEventStream(coordRoot);
     ensureDir(dirname(streamPath));
     ensureFile(lockPath);
     let line = `${JSON.stringify(envelope)}\n`;

package/dist/core/hooks/events/rotate.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Size-triggered rotation for the canonical event stream
+ * `.harnery/events.ndjson`.
+ *
+ * The stream is a deliberately-immutable, append-only ledger. Left unbounded it
+ * grows past V8's ~512MB max string length, at which point any code that does a
+ * whole-file `readFileSync` throws ("Cannot create a string longer than
+ * 0x1fffffe8 characters"). Rather than police every current + future reader,
+ * we bound the *active* file: once it crosses a byte cap we rename it to a dated
+ * archive (`events-YYYY-MM-DD.ndjson`) and start a fresh active file. Archives
+ * are kept — the audit trail is preserved, just spread across files that readers
+ * glob newest-first.
+ *
+ * Both independent append paths (agent-hooks `hooks/events/emit.ts` and
+ * agent-coord `agents/events/emit.ts`) call `maybeRotateEventStream` before
+ * appending, so a roll is triggered continuously, not only at session
+ * boundaries.
+ *
+ * Concurrency: many short-lived hook processes append at once. The rename itself
+ * is atomic — a concurrent appender opening the path by name lands its line in
+ * whichever inode the name currently resolves to (old archive or new active
+ * file), never nowhere. The only hazard is two processes both renaming (the
+ * second would move the fresh empty file to a second archive name), which an
+ * `O_EXCL` roll-lock prevents.
+ *
+ * Design + rationale: harnery ADR 0009; decision docket
+ * `should-harnery-adopt-a-retention-2026-07-07-ed07`.
+ */
+/** Archive glob prefix. Readers enumerate `events-*.ndjson` newest-first.
+ * The pre-existing manual `events-legacy.ndjson` matches and is picked up for
+ * free. Kept in sync with the reader-side pattern in web/lib/coord-reader.ts. */
+export declare const ARCHIVE_PREFIX = "events-";
+export declare const ARCHIVE_SUFFIX = ".ndjson";
+/**
+ * Roll `events.ndjson` to a dated archive when it exceeds the byte cap. Cheap
+ * no-op (a single `statSync`) below the cap. Fail-soft: any error is swallowed
+ * so a rotation problem can never break the append that triggered it.
+ *
+ * `nowMs` is injectable for the stale-lock check in tests; production leaves it
+ * unset (the roll date always comes from the file's mtime, never `nowMs`).
+ */
+export declare function maybeRotateEventStream(coordRoot: string, nowMs?: number): boolean;
+//# sourceMappingURL=rotate.d.ts.map

package/dist/core/hooks/events/rotate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotate.d.ts","sourceRoot":"","sources":["../../../../src/core/hooks/events/rotate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAyBH;;iFAEiF;AACjF,eAAO,MAAM,cAAc,YAAY,CAAC;AACxC,eAAO,MAAM,cAAc,YAAY,CAAC;AA6BxC;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAmCjF"}

package/dist/core/hooks/events/rotate.js

@@ -0,0 +1,142 @@
+/**
+ * Size-triggered rotation for the canonical event stream
+ * `.harnery/events.ndjson`.
+ *
+ * The stream is a deliberately-immutable, append-only ledger. Left unbounded it
+ * grows past V8's ~512MB max string length, at which point any code that does a
+ * whole-file `readFileSync` throws ("Cannot create a string longer than
+ * 0x1fffffe8 characters"). Rather than police every current + future reader,
+ * we bound the *active* file: once it crosses a byte cap we rename it to a dated
+ * archive (`events-YYYY-MM-DD.ndjson`) and start a fresh active file. Archives
+ * are kept — the audit trail is preserved, just spread across files that readers
+ * glob newest-first.
+ *
+ * Both independent append paths (agent-hooks `hooks/events/emit.ts` and
+ * agent-coord `agents/events/emit.ts`) call `maybeRotateEventStream` before
+ * appending, so a roll is triggered continuously, not only at session
+ * boundaries.
+ *
+ * Concurrency: many short-lived hook processes append at once. The rename itself
+ * is atomic — a concurrent appender opening the path by name lands its line in
+ * whichever inode the name currently resolves to (old archive or new active
+ * file), never nowhere. The only hazard is two processes both renaming (the
+ * second would move the fresh empty file to a second archive name), which an
+ * `O_EXCL` roll-lock prevents.
+ *
+ * Design + rationale: harnery ADR 0009; decision docket
+ * `should-harnery-adopt-a-retention-2026-07-07-ed07`.
+ */
+import { closeSync, existsSync, mkdirSync, openSync, renameSync, statSync, unlinkSync, } from "node:fs";
+import { dirname, join } from "node:path";
+import { coordEnv } from "../../../lib/env.js";
+const STREAM_FILE = ".harnery/events.ndjson";
+const ROLL_LOCK_FILE = ".harnery/events.ndjson.roll.lock";
+/** Default active-file cap: 256 MiB — half of V8's ~512MB string cliff, so even
+ * a reader that loads the whole active file whole stays clear of the limit. */
+const DEFAULT_ROLL_BYTES = 256 * 1024 * 1024;
+/** A roll-lock older than this is treated as abandoned (a crashed roller) and
+ * stolen. Rolls are sub-millisecond, so 60s is orders of magnitude of slack. */
+const STALE_LOCK_MS = 60_000;
+/** Archive glob prefix. Readers enumerate `events-*.ndjson` newest-first.
+ * The pre-existing manual `events-legacy.ndjson` matches and is picked up for
+ * free. Kept in sync with the reader-side pattern in web/lib/coord-reader.ts. */
+export const ARCHIVE_PREFIX = "events-";
+export const ARCHIVE_SUFFIX = ".ndjson";
+function resolveRollBytes() {
+    const env = coordEnv("EVENTS_ROLL_BYTES");
+    const n = env ? Number(env) : Number.NaN;
+    return Number.isFinite(n) && n > 0 ? n : DEFAULT_ROLL_BYTES;
+}
+/** `YYYY-MM-DD` (UTC) from a millisecond timestamp. Uses the file's own mtime
+ * rather than `Date.now()` so it's deterministic and independent of the harness
+ * runtime's clock surface. */
+function utcDateStamp(mtimeMs) {
+    const d = new Date(mtimeMs);
+    const y = d.getUTCFullYear();
+    const mo = String(d.getUTCMonth() + 1).padStart(2, "0");
+    const day = String(d.getUTCDate()).padStart(2, "0");
+    return `${y}-${mo}-${day}`;
+}
+/** First non-colliding `events-<stamp>[.N].ndjson` path under `coordDir`. */
+function archivePathFor(coordDir, stamp) {
+    const base = join(coordDir, `${ARCHIVE_PREFIX}${stamp}${ARCHIVE_SUFFIX}`);
+    if (!existsSync(base))
+        return base;
+    for (let n = 1;; n++) {
+        const cand = join(coordDir, `${ARCHIVE_PREFIX}${stamp}.${n}${ARCHIVE_SUFFIX}`);
+        if (!existsSync(cand))
+            return cand;
+    }
+}
+/**
+ * Roll `events.ndjson` to a dated archive when it exceeds the byte cap. Cheap
+ * no-op (a single `statSync`) below the cap. Fail-soft: any error is swallowed
+ * so a rotation problem can never break the append that triggered it.
+ *
+ * `nowMs` is injectable for the stale-lock check in tests; production leaves it
+ * unset (the roll date always comes from the file's mtime, never `nowMs`).
+ */
+export function maybeRotateEventStream(coordRoot, nowMs) {
+    try {
+        const streamPath = join(coordRoot, STREAM_FILE);
+        if (!existsSync(streamPath))
+            return false;
+        const cap = resolveRollBytes();
+        let st = statSync(streamPath);
+        if (st.size < cap)
+            return false;
+        const coordDir = dirname(streamPath);
+        const lockPath = join(coordRoot, ROLL_LOCK_FILE);
+        mkdirSync(coordDir, { recursive: true });
+        if (!acquireRollLock(lockPath, nowMs))
+            return false; // another roller active
+        try {
+            // Re-check under the lock: a concurrent process may have just rolled.
+            if (!existsSync(streamPath))
+                return false;
+            st = statSync(streamPath);
+            if (st.size < cap)
+                return false;
+            const archive = archivePathFor(coordDir, utcDateStamp(st.mtimeMs));
+            renameSync(streamPath, archive);
+            // Recreate an empty active file so the very next append (and any reader's
+            // existsSync) sees a valid, present stream.
+            closeSync(openSync(streamPath, "a"));
+            return true;
+        }
+        finally {
+            try {
+                unlinkSync(lockPath);
+            }
+            catch {
+                /* best-effort */
+            }
+        }
+    }
+    catch {
+        return false; // fail-soft: never break the caller's append
+    }
+}
+/** Create the roll-lock with O_EXCL. Returns true on acquisition. On collision,
+ * steals a stale lock (crashed roller) once, else returns false. */
+function acquireRollLock(lockPath, nowMs) {
+    try {
+        closeSync(openSync(lockPath, "wx"));
+        return true;
+    }
+    catch {
+        // Exists: steal if abandoned.
+        try {
+            const age = (nowMs ?? Date.now()) - statSync(lockPath).mtimeMs;
+            if (age > STALE_LOCK_MS) {
+                unlinkSync(lockPath);
+                closeSync(openSync(lockPath, "wx"));
+                return true;
+            }
+        }
+        catch {
+            /* lost the steal race — someone else holds it */
+        }
+        return false;
+    }
+}

package/dist/core/hooks/harness/events.d.ts

@@ -30,6 +30,12 @@ export interface HarnessSpec {
     entryShape: HookEntryShape;
     /** When set, ensure this top-level `version` key in the file (Cursor requires `1`). */
     rootVersion?: number;
+    /** Harness-owned entries from older specs that `init` should remove during migration. */
+    legacyEvents?: HookEvent[];
+    /** Strict top-level settings keys accepted by this harness, when its parser is closed. */
+    allowedTopLevelKeys?: string[];
+    /** Strict hook event keys accepted by this harness, including events harnery does not wire. */
+    allowedEventKeys?: string[];
 }
 /** Claude Code: `.claude/settings.json`. */
 export declare const CLAUDE_CODE_EVENTS: HookEvent[];
@@ -38,8 +44,12 @@ export declare const CLAUDE_CODE_EVENTS: HookEvent[];
  * no `StopFailure` event, but a distinct `beforeShellExecution` (shell-mutation warn).
  */
 export declare const CURSOR_EVENTS: HookEvent[];
-/** Codex: `.codex/hooks.json`. PascalCase keys + the same entry shape as Claude Code. */
+/** Codex events that harnery uses from the current native lifecycle surface. */
 export declare const CODEX_EVENTS: HookEvent[];
+/** Entries written by harnery before Codex adopted a strict native hook schema. */
+export declare const LEGACY_CODEX_EVENTS: HookEvent[];
+/** Every hook key accepted by Codex 0.144, including events harnery does not consume. */
+export declare const CODEX_ALLOWED_EVENT_KEYS: string[];
 /** Every supported harness, fully wireable by `harn init`. */
 export declare const HARNESS_SPECS: Record<HarnessId, HarnessSpec>;
 //# sourceMappingURL=events.d.ts.map

package/dist/core/hooks/harness/events.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../../../src/core/hooks/harness/events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,MAAM,SAAS,GAAG,aAAa,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE3D,MAAM,WAAW,SAAS;IACxB,6FAA6F;IAC7F,WAAW,EAAE,MAAM,CAAC;IACpB,sDAAsD;IACtD,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEjD,MAAM,WAAW,WAAW;IAC1B,2DAA2D;IAC3D,YAAY,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,MAAM,EAAE,SAAS,EAAE,CAAC;IACpB,wDAAwD;IACxD,UAAU,EAAE,cAAc,CAAC;IAC3B,uFAAuF;IACvF,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,4CAA4C;AAC5C,eAAO,MAAM,kBAAkB,EAAE,SAAS,EAWzC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,EAWpC,CAAC;AAEF,yFAAyF;AACzF,eAAO,MAAM,YAAY,EAAE,SAAS,EAWnC,CAAC;AAEF,8DAA8D;AAC9D,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,SAAS,EAAE,WAAW,CAiBxD,CAAC"}
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../../../src/core/hooks/harness/events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,MAAM,SAAS,GAAG,aAAa,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE3D,MAAM,WAAW,SAAS;IACxB,6FAA6F;IAC7F,WAAW,EAAE,MAAM,CAAC;IACpB,sDAAsD;IACtD,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEjD,MAAM,WAAW,WAAW;IAC1B,2DAA2D;IAC3D,YAAY,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,MAAM,EAAE,SAAS,EAAE,CAAC;IACpB,wDAAwD;IACxD,UAAU,EAAE,cAAc,CAAC;IAC3B,uFAAuF;IACvF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yFAAyF;IACzF,YAAY,CAAC,EAAE,SAAS,EAAE,CAAC;IAC3B,0FAA0F;IAC1F,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,+FAA+F;IAC/F,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,4CAA4C;AAC5C,eAAO,MAAM,kBAAkB,EAAE,SAAS,EAWzC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,EAWpC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,YAAY,EAAE,SAAS,EAQnC,CAAC;AAEF,mFAAmF;AACnF,eAAO,MAAM,mBAAmB,EAAE,SAAS,EAI1C,CAAC;AAEF,yFAAyF;AACzF,eAAO,MAAM,wBAAwB,UAWpC,CAAC;AAEF,8DAA8D;AAC9D,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,SAAS,EAAE,WAAW,CAoBxD,CAAC"}

package/dist/core/hooks/harness/events.js

@@ -37,19 +37,35 @@ export const CURSOR_EVENTS = [
     { settingsKey: "beforeSubmitPrompt", subcommand: "user-prompt-submit" },
     { settingsKey: "stop", subcommand: "stop" },
 ];
-/** Codex: `.codex/hooks.json`. PascalCase keys + the same entry shape as Claude Code. */
+/** Codex events that harnery uses from the current native lifecycle surface. */
 export const CODEX_EVENTS = [
     { settingsKey: "SessionStart", subcommand: "session-start" },
-    { settingsKey: "SessionEnd", subcommand: "session-end" },
     { settingsKey: "PreToolUse", subcommand: "pre-tool-use" },
     { settingsKey: "PostToolUse", subcommand: "post-tool-use" },
-    { settingsKey: "PostToolUseFailure", subcommand: "post-tool-use-failure" },
     { settingsKey: "UserPromptSubmit", subcommand: "user-prompt-submit" },
     { settingsKey: "SubagentStart", subcommand: "sub-agent-start" },
     { settingsKey: "SubagentStop", subcommand: "sub-agent-stop" },
     { settingsKey: "Stop", subcommand: "stop" },
+];
+/** Entries written by harnery before Codex adopted a strict native hook schema. */
+export const LEGACY_CODEX_EVENTS = [
+    { settingsKey: "SessionEnd", subcommand: "session-end" },
+    { settingsKey: "PostToolUseFailure", subcommand: "post-tool-use-failure" },
     { settingsKey: "StopFailure", subcommand: "stop-failure" },
 ];
+/** Every hook key accepted by Codex 0.144, including events harnery does not consume. */
+export const CODEX_ALLOWED_EVENT_KEYS = [
+    "SessionStart",
+    "PreToolUse",
+    "PermissionRequest",
+    "PostToolUse",
+    "PreCompact",
+    "PostCompact",
+    "UserPromptSubmit",
+    "SubagentStart",
+    "SubagentStop",
+    "Stop",
+];
 /** Every supported harness, fully wireable by `harn init`. */
 export const HARNESS_SPECS = {
     "claude-code": {
@@ -67,5 +83,8 @@ export const HARNESS_SPECS = {
         settingsFile: ".codex/hooks.json",
         events: CODEX_EVENTS,
         entryShape: "claude",
+        legacyEvents: LEGACY_CODEX_EVENTS,
+        allowedTopLevelKeys: ["description", "hooks"],
+        allowedEventKeys: CODEX_ALLOWED_EVENT_KEYS,
     },
 };

package/dist/core/hooks/harness/wiring.d.ts

@@ -28,6 +28,7 @@ export interface CursorHookGroup {
 export type HookGroup = ClaudeHookGroup | CursorHookGroup;
 export interface SettingsFile {
     version?: number;
+    description?: string;
     hooks?: Record<string, HookGroup[]>;
     [k: string]: unknown;
 }
@@ -51,6 +52,10 @@ export interface WiringDiff {
      * these — they need explicit removal — so they're surfaced separately.
      */
     orphans: string[];
+    /** Settings fields rejected by a harness with a strict top-level schema. */
+    invalidTopLevelKeys: string[];
+    /** Hook event names rejected by a harness with a strict event schema. */
+    invalidEventKeys: string[];
 }
 /**
  * Pure diff of one settings object against one harness spec. Read-only inverse
@@ -63,6 +68,9 @@ export interface HarnessWiringStatus {
     settingsFile: string;
     missing: HookEvent[];
     orphans: string[];
+    invalidTopLevelKeys: string[];
+    invalidEventKeys: string[];
+    parseError?: string;
 }
 /**
  * Inspect every harness whose settings file exists under `projectRoot` and

package/dist/core/hooks/harness/wiring.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wiring.d.ts","sourceRoot":"","sources":["../../../../src/core/hooks/harness/wiring.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,SAAS,EACf,MAAM,aAAa,CAAC;AAErB,mEAAmE;AACnE,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC5C;AACD,0CAA0C;AAC1C,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AACD,MAAM,MAAM,SAAS,GAAG,eAAe,GAAG,eAAe,CAAC;AAE1D,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACpC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAED,iDAAiD;AACjD,wBAAgB,SAAS,CAAC,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,CAE3E;AAED,0EAA0E;AAC1E,wBAAgB,aAAa,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,EAAE,CAMxD;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAEnF;AAQD,MAAM,WAAW,UAAU;IACzB,kDAAkD;IAClD,OAAO,EAAE,SAAS,EAAE,CAAC;IACrB,iCAAiC;IACjC,OAAO,EAAE,SAAS,EAAE,CAAC;IACrB;;;;OAIG;IACH,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,GAAG,UAAU,CA0BhF;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,SAAS,CAAC;IACnB,wDAAwD;IACxD,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,SAAS,EAAE,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,mBAAmB,EAAE,CAwB5E;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAkBvC"}
+{"version":3,"file":"wiring.d.ts","sourceRoot":"","sources":["../../../../src/core/hooks/harness/wiring.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,SAAS,EACf,MAAM,aAAa,CAAC;AAErB,mEAAmE;AACnE,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC5C;AACD,0CAA0C;AAC1C,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AACD,MAAM,MAAM,SAAS,GAAG,eAAe,GAAG,eAAe,CAAC;AAE1D,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACpC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAED,iDAAiD;AACjD,wBAAgB,SAAS,CAAC,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,CAE3E;AAED,0EAA0E;AAC1E,wBAAgB,aAAa,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,EAAE,CAMxD;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAEnF;AAQD,MAAM,WAAW,UAAU;IACzB,kDAAkD;IAClD,OAAO,EAAE,SAAS,EAAE,CAAC;IACrB,iCAAiC;IACjC,OAAO,EAAE,SAAS,EAAE,CAAC;IACrB;;;;OAIG;IACH,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,4EAA4E;IAC5E,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,yEAAyE;IACzE,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,GAAG,UAAU,CA2ChF;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,SAAS,CAAC;IACnB,wDAAwD;IACxD,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,SAAS,EAAE,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,mBAAmB,EAAE,CAwC5E;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAkBvC"}

package/dist/core/hooks/harness/wiring.js

@@ -65,7 +65,23 @@ export function diffWiring(settings, spec) {
             }
         }
     }
-    return { missing, present, orphans: [...orphans].sort() };
+    const invalidTopLevelKeys = spec.allowedTopLevelKeys
+        ? Object.keys(settings)
+            .filter((key) => !spec.allowedTopLevelKeys.includes(key))
+            .sort()
+        : [];
+    const invalidEventKeys = spec.allowedEventKeys
+        ? Object.keys(hooks)
+            .filter((key) => !spec.allowedEventKeys.includes(key))
+            .sort()
+        : [];
+    return {
+        missing,
+        present,
+        orphans: [...orphans].sort(),
+        invalidTopLevelKeys,
+        invalidEventKeys,
+    };
 }
 /**
  * Inspect every harness whose settings file exists under `projectRoot` and
@@ -88,21 +104,34 @@ export function loadHarnessWiring(projectRoot) {
         try {
             settings = JSON.parse(readFileSync(settingsPath, "utf8"));
         }
-        catch {
-            // Unparseable settings file: can't tell opt-in from noise, and the
-            // harness itself will complain about its own malformed config. Skip.
+        catch (error) {
+            out.push({
+                harness: id,
+                settingsFile: spec.settingsFile,
+                missing: [],
+                orphans: [],
+                invalidTopLevelKeys: [],
+                invalidEventKeys: [],
+                parseError: error.message,
+            });
             continue;
         }
         const diff = diffWiring(settings, spec);
         if (diff.present.length === 0)
             continue; // not opted in → not drift
-        if (diff.missing.length === 0 && diff.orphans.length === 0)
+        if (diff.missing.length === 0 &&
+            diff.orphans.length === 0 &&
+            diff.invalidTopLevelKeys.length === 0 &&
+            diff.invalidEventKeys.length === 0) {
             continue; // current
+        }
         out.push({
             harness: id,
             settingsFile: spec.settingsFile,
             missing: diff.missing,
             orphans: diff.orphans,
+            invalidTopLevelKeys: diff.invalidTopLevelKeys,
+            invalidEventKeys: diff.invalidEventKeys,
         });
     }
     return out;

package/dist/core/scratch/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/scratch/index.ts"],"names":[],"mappings":"AAcA;;;;;;;;;;;;GAYG;AAEH,eAAO,MAAM,kBAAkB,iFAQrB,CAAC;AAEX,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAElE,eAAO,MAAM,iBAAiB,QAAY,CAAC;AAC3C,eAAO,MAAM,kBAAkB,QAAY,CAAC;AAC5C,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC,6DAA6D;AAC7D,eAAO,MAAM,eAAe,QACyF,CAAC;AAEtH,mFAAmF;AACnF,eAAO,MAAM,wBAAwB,yBAAyB,CAAC;AAE/D,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,eAAe,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,aAAa,CAAC;IACtB,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;CACf;AAID,wBAAgB,UAAU,IAAI,MAAM,CAMnC;AAED,wBAAgB,UAAU,IAAI,MAAM,CAInC;AAED,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEtD;AAeD,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,CAAC,GAAE,IAAiB,GAAG,MAAM,CAW1D;AAID,wEAAwE;AACxE,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,CA+DtE;AAED,+CAA+C;AAC/C,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,CAkBxD;AAmBD,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,SAAoB,GAAG,SAAS,EAAE,CA2DrF;AAID,wBAAgB,WAAW,CACzB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,eAAe,EACzB,IAAI,EAAE,MAAM,GACX,UAAU,CAgEZ;AAID,wGAAwG;AACxG,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOhE;AAED,iEAAiE;AACjE,wBAAgB,aAAa,CAAC,IAAI,SAAyB,GAAG,MAAM,CAkBnE;AAED,uFAAuF;AACvF,wBAAgB,sBAAsB,IAAI,MAAM,EAAE,CAajD;AAED,qDAAqD;AACrD,wBAAgB,YAAY,IAAI;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf,EAAE,CAWF;AAID,wBAAgB,mBAAmB,IAAI,MAAM,CAM5C;AAED,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAIjE;AAED,2FAA2F;AAC3F,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAoB9D"}

package/dist/{lib → core}/scratch/index.js

@@ -1,7 +1,7 @@
 import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
 import { dirname, resolve } from "node:path";
-import { monorepoRoot, readHeartbeat, resolveOwner } from "../../core/agents/index.js";
-import { resolveMachineLabel } from "../machine.js";
+import { resolveMachineLabel } from "../../lib/machine.js";
+import { monorepoRoot, readHeartbeat, resolveOwner } from "../agents/index.js";
 /**
  * Agent scratchpad: per-agent markdown journal at `.harnery/scratch/<instance_id>.md`.
  *