harness-everything 0.10.0 → 0.11.1

package/docs/contract-integrity.md

@@ -0,0 +1,109 @@
+# Contract Integrity Audit
+
+The contract-integrity audit reconciles the chain:
+
+```text
+ADR decision -> living spec requirement -> ticket/change
+-> #58 completeness evidence -> predeclared protection probes
+-> implementation evidence
+```
+
+Phase 1 is a **trace/reconciliation engine**. It does not yet generate or execute mutation probes. A green existing suite therefore cannot manufacture a protection PASS.
+
+## Inputs
+
+`contract-integrity/schemas/trace.schema.json` defines version `1.0.0`.
+
+Every current requirement has:
+
+- a stable `requirementId` and revision;
+- one current living spec;
+- zero or more governing ADR decisions;
+- linked tickets, tests, and implementation evidence;
+- **predeclared** `requiredProbeIds`;
+- explicit source validity.
+
+Artifacts use stable IDs and lifecycle state instead of appending ticket history into ADR text.
+
+Protection probe dispositions are:
+
+- `KILLED`: valid only when an isolated source-derived contract probe fails for the expected contract reason;
+- `SURVIVED`: the implementation violated the contract and the tests did not stop it;
+- `INVALID`: build/infrastructure/flaky or otherwise unusable evidence;
+- `NOT_EVALUATED`: not executed.
+
+A compile/build failure is never counted as a killed contract probe.
+
+## Scoring
+
+Completeness is not reimplemented. Pass `--tdd-evidence` and Harness calls the existing #58 evaluator.
+
+Protection is intentionally anti-padding:
+
+1. each requirement declares `requiredProbeIds` before execution;
+2. only those probe IDs affect its score;
+3. a requirement is 100 only when **every required probe is validly KILLED**;
+4. any required `SURVIVED` probe makes that requirement 0;
+5. missing/invalid/not-evaluated required evidence also gives 0 and `NOT_EVALUATED`;
+6. extra killed probes do not change the requirement score.
+
+The project score is:
+
+```text
+contractIntegrityScore = min(completenessScore, protectionScore)
+```
+
+Scores never override a drift or evidence gate.
+
+## Drift vocabulary
+
+The machine report uses:
+
+- `CONSISTENT`
+- `UNTRACED_CHANGE`
+- `STALE_SPEC`
+- `STALE_TEST`
+- `STALE_IMPLEMENTATION`
+- `SOURCE_DEFECT`
+- `SOURCE_CONFLICT`
+- `INTENTIONAL_SUPERSESSION`
+- `NOT_EVALUATED`
+
+A ticket with behavior/architecture impact targeting a newer requirement revision than the living spec is `STALE_SPEC + UNTRACED_CHANGE`. Test/probe evidence must point to the current living spec, not merely have a green score.
+
+## CLI
+
+```bash
+node contract-integrity/scripts/audit.js trace.json \
+  --tdd-evidence tdd-evidence.json \
+  --output contract-report.json \
+  --markdown contract-report.md
+```
+
+Or:
+
+```bash
+npm run contract:integrity -- trace.json --tdd-evidence tdd-evidence.json
+```
+
+### Modes
+
+`strict`
+: unresolved drift, missing completeness evidence, surviving/invalid/missing probes, source defects/conflicts, or a score below 100 fail the completion gate.
+
+`audit`
+: intended for migration of legacy projects. It returns an audit report and exits zero for valid input even when debt exists, but `gateEligible` remains false and it **cannot authorize completion**.
+
+Malformed input/evidence returns exit 2 in either mode.
+
+## Reports
+
+JSON contains raw artifact/requirement/probe counts, both component scores, integrity score, drift counts, per-requirement reason codes, and the compact contract graph.
+
+Markdown stays concise. Detailed lineage belongs in the generated graph/report, not as raw ticket chronology appended to ADRs/specs.
+
+## Phase boundary
+
+Phase 1 consumes declared probe evidence but does not create it. Phase 3 of #84 will define project adapters and execute source-derived probes in isolated/recoverable workspaces. Until then, absent probe evidence is `NOT_EVALUATED`, never PASS.
+
+No new directly routed skill is introduced in Phase 1. Phase 2 must first review routing/description collision before integrating this audit into `grill-with-docs`, `to-spec`, `to-tickets`, or completion workflows.

package/hooks/scripts/lib/workflow-runtime.js

@@ -7,6 +7,7 @@ const { atomicWriteJson, readJson } = require('./fable-contracts');
 
 const OPEN_STATES = new Set(['pending', 'active', 'running', 'failed', 'blocked', 'escaped']);
 const SAFE_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+const WORKFLOW_CONTROLLER_COMMANDS = new Set(['start', 'revision', 'reset-budget', 'escape', 'block']);
 
 function isMajorWorkflow(workflow) {
   return Boolean(workflow && (workflow.mutationIsolation?.required || workflow.tier === 'tier3' || String(workflow.strategy || '').startsWith('fable-')));
@@ -251,4 +252,4 @@ function readHookInput(decide) {
   process.stdin.on('error', finish);
 }
 
-module.exports = { OPEN_STATES, SAFE_ID, isMajorWorkflow, loadWorkflow, saveWorkflow, budgetLimits, ensureWorkflowBudget, recordBudgetEvent, resetWorkflowBudget, syncBudgetToRun, matchingRun, unresolvedStages, readHookInput };
+module.exports = { OPEN_STATES, SAFE_ID, WORKFLOW_CONTROLLER_COMMANDS, isMajorWorkflow, loadWorkflow, saveWorkflow, budgetLimits, ensureWorkflowBudget, recordBudgetEvent, resetWorkflowBudget, syncBudgetToRun, matchingRun, unresolvedStages, readHookInput };

package/hooks/scripts/workflow-disposition.js

@@ -3,7 +3,7 @@
 
 const fs = require('fs');
 const path = require('path');
-const { loadWorkflow, saveWorkflow, matchingRun, OPEN_STATES, ensureWorkflowBudget, recordBudgetEvent, resetWorkflowBudget, syncBudgetToRun } = require('./lib/workflow-runtime');
+const { loadWorkflow, saveWorkflow, matchingRun, OPEN_STATES, ensureWorkflowBudget, recordBudgetEvent, resetWorkflowBudget, syncBudgetToRun, WORKFLOW_CONTROLLER_COMMANDS } = require('./lib/workflow-runtime');
 const { getWorkspaceRoot, readCurrentSession } = require('./lib/harness-state');
 const { atomicWriteJson, readJson } = require('./lib/fable-contracts');
 
@@ -20,6 +20,10 @@ function parseArgs(argv) {
   return args;
 }
 
+function usage() {
+  return `Usage: workflow-disposition.js <${[...WORKFLOW_CONTROLLER_COMMANDS].join('|')}> --session-id <id> [--stage-id <id> --reason-code <reason> --scope <scope> --evidence <evidence>]`;
+}
+
 function consumer() {
   for (const relative of ['../../fable-mode/scripts/workflow-plan-consumer.js', '../../skills/fable-mode/scripts/workflow-plan-consumer.js']) {
     const file = path.resolve(__dirname, relative);
@@ -30,6 +34,7 @@ function consumer() {
 
 function main() {
   const args = parseArgs(process.argv.slice(2));
+  if (!WORKFLOW_CONTROLLER_COMMANDS.has(args.command)) throw new Error(usage());
   const sessionId = args.sessionId || readCurrentSession(getWorkspaceRoot());
   if (!sessionId) throw new Error('no active Harness session; pass --session-id explicitly');
   const context = loadWorkflow({ session_id: sessionId });
@@ -96,7 +101,7 @@ function main() {
     if (!args.evidence?.trim()) throw new Error('--evidence is required');
     workflow.state = 'blocked';
     workflow.blockReason = args.evidence.trim();
-  } else throw new Error('Usage: workflow-disposition.js <start|revision|reset-budget|escape|block> --session-id <id> [--stage-id <id> --reason-code <reason> --scope <scope> --evidence <evidence>]');
+  } else throw new Error(usage());
   saveWorkflow(context);
   syncBudgetToRun(context);
   process.stdout.write(JSON.stringify({ state: workflow.state, workflowId: workflow.workflowId, runId: workflow.runId, revision: workflow.revision, escapes: workflow.escapes }) + '\n');

package/hooks/scripts/workflow-gate.js

@@ -3,7 +3,7 @@
 
 const path = require('path');
 const fs = require('fs');
-const { loadWorkflow, saveWorkflow, isMajorWorkflow, matchingRun, recordBudgetEvent, readHookInput } = require('./lib/workflow-runtime');
+const { loadWorkflow, saveWorkflow, isMajorWorkflow, matchingRun, recordBudgetEvent, readHookInput, WORKFLOW_CONTROLLER_COMMANDS } = require('./lib/workflow-runtime');
 const { key, classifyShell, cwdOf, commandOf, mutationPaths, linkedWorktree, assertTargets, assertShellScope } = require('./lib/workflow-isolation');
 
 const DIRECT = new Set(['Edit', 'Write', 'apply_patch']);
@@ -12,8 +12,9 @@ const SHELL = new Set(['Bash', 'PowerShell', 'exec_command']);
 function isController(command, cwd) {
   // One trusted local executable, literal arguments, no shell evaluation.
   if (/[;&|`\r\n<>$(){}]/.test(command)) return false;
-  const match = command.match(/^node\s+(?:"([^"]+)"|'([^']+)'|(\S+))\s+(start|escape|block)\b/);
-  return Boolean(match && key(path.resolve(cwd, match[1] || match[2] || match[3])) === key(path.join(__dirname, 'workflow-disposition.js')));
+  const match = command.match(/^node\s+(?:"([^"]+)"|'([^']+)'|(\S+))\s+([A-Za-z][A-Za-z0-9-]*)\b/);
+  return Boolean(match && WORKFLOW_CONTROLLER_COMMANDS.has(match[4]) &&
+    key(path.resolve(cwd, match[1] || match[2] || match[3])) === key(path.join(__dirname, 'workflow-disposition.js')));
 }
 
 function decide(payload) {

package/opencode-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-enforcement",
   "description": "Repository inventory for the opencode enforcement plugin and its standalone helper",
-  "version": "0.10.0",
+  "version": "0.11.1",
   "runtime": "index.mjs",
   "hooks": {
     "verify": "hooks/verify.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.10.0",
+  "version": "0.11.1",
   "description": "Harness OS: An Orchestrated Agent Operating System for AI-driven Development",
   "main": "harness-everything/scripts/bootstrap.js",
   "bin": {
@@ -50,7 +50,9 @@
     "commitlint": "commitlint --edit",
     "test:telemetry": "node ci/telemetry.test.js",
     "telemetry:report": "node telemetry/scripts/report.js",
-    "telemetry:benchmark": "node telemetry/scripts/benchmark.js"
+    "telemetry:benchmark": "node telemetry/scripts/benchmark.js",
+    "test:contract-integrity": "node ci/contract-integrity.test.js",
+    "contract:integrity": "node contract-integrity/scripts/audit.js"
   },
   "engines": {
     "node": ">=22"

package/plugins/harness-everything/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.10.0",
+  "version": "0.11.1",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/hooks/scripts/lib/workflow-runtime.js

@@ -7,6 +7,7 @@ const { atomicWriteJson, readJson } = require('./fable-contracts');
 
 const OPEN_STATES = new Set(['pending', 'active', 'running', 'failed', 'blocked', 'escaped']);
 const SAFE_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+const WORKFLOW_CONTROLLER_COMMANDS = new Set(['start', 'revision', 'reset-budget', 'escape', 'block']);
 
 function isMajorWorkflow(workflow) {
   return Boolean(workflow && (workflow.mutationIsolation?.required || workflow.tier === 'tier3' || String(workflow.strategy || '').startsWith('fable-')));
@@ -251,4 +252,4 @@ function readHookInput(decide) {
   process.stdin.on('error', finish);
 }
 
-module.exports = { OPEN_STATES, SAFE_ID, isMajorWorkflow, loadWorkflow, saveWorkflow, budgetLimits, ensureWorkflowBudget, recordBudgetEvent, resetWorkflowBudget, syncBudgetToRun, matchingRun, unresolvedStages, readHookInput };
+module.exports = { OPEN_STATES, SAFE_ID, WORKFLOW_CONTROLLER_COMMANDS, isMajorWorkflow, loadWorkflow, saveWorkflow, budgetLimits, ensureWorkflowBudget, recordBudgetEvent, resetWorkflowBudget, syncBudgetToRun, matchingRun, unresolvedStages, readHookInput };

package/plugins/harness-everything/hooks/scripts/workflow-disposition.js

@@ -3,7 +3,7 @@
 
 const fs = require('fs');
 const path = require('path');
-const { loadWorkflow, saveWorkflow, matchingRun, OPEN_STATES, ensureWorkflowBudget, recordBudgetEvent, resetWorkflowBudget, syncBudgetToRun } = require('./lib/workflow-runtime');
+const { loadWorkflow, saveWorkflow, matchingRun, OPEN_STATES, ensureWorkflowBudget, recordBudgetEvent, resetWorkflowBudget, syncBudgetToRun, WORKFLOW_CONTROLLER_COMMANDS } = require('./lib/workflow-runtime');
 const { getWorkspaceRoot, readCurrentSession } = require('./lib/harness-state');
 const { atomicWriteJson, readJson } = require('./lib/fable-contracts');
 
@@ -20,6 +20,10 @@ function parseArgs(argv) {
   return args;
 }
 
+function usage() {
+  return `Usage: workflow-disposition.js <${[...WORKFLOW_CONTROLLER_COMMANDS].join('|')}> --session-id <id> [--stage-id <id> --reason-code <reason> --scope <scope> --evidence <evidence>]`;
+}
+
 function consumer() {
   for (const relative of ['../../fable-mode/scripts/workflow-plan-consumer.js', '../../skills/fable-mode/scripts/workflow-plan-consumer.js']) {
     const file = path.resolve(__dirname, relative);
@@ -30,6 +34,7 @@ function consumer() {
 
 function main() {
   const args = parseArgs(process.argv.slice(2));
+  if (!WORKFLOW_CONTROLLER_COMMANDS.has(args.command)) throw new Error(usage());
   const sessionId = args.sessionId || readCurrentSession(getWorkspaceRoot());
   if (!sessionId) throw new Error('no active Harness session; pass --session-id explicitly');
   const context = loadWorkflow({ session_id: sessionId });
@@ -96,7 +101,7 @@ function main() {
     if (!args.evidence?.trim()) throw new Error('--evidence is required');
     workflow.state = 'blocked';
     workflow.blockReason = args.evidence.trim();
-  } else throw new Error('Usage: workflow-disposition.js <start|revision|reset-budget|escape|block> --session-id <id> [--stage-id <id> --reason-code <reason> --scope <scope> --evidence <evidence>]');
+  } else throw new Error(usage());
   saveWorkflow(context);
   syncBudgetToRun(context);
   process.stdout.write(JSON.stringify({ state: workflow.state, workflowId: workflow.workflowId, runId: workflow.runId, revision: workflow.revision, escapes: workflow.escapes }) + '\n');

package/plugins/harness-everything/hooks/scripts/workflow-gate.js

@@ -3,7 +3,7 @@
 
 const path = require('path');
 const fs = require('fs');
-const { loadWorkflow, saveWorkflow, isMajorWorkflow, matchingRun, recordBudgetEvent, readHookInput } = require('./lib/workflow-runtime');
+const { loadWorkflow, saveWorkflow, isMajorWorkflow, matchingRun, recordBudgetEvent, readHookInput, WORKFLOW_CONTROLLER_COMMANDS } = require('./lib/workflow-runtime');
 const { key, classifyShell, cwdOf, commandOf, mutationPaths, linkedWorktree, assertTargets, assertShellScope } = require('./lib/workflow-isolation');
 
 const DIRECT = new Set(['Edit', 'Write', 'apply_patch']);
@@ -12,8 +12,9 @@ const SHELL = new Set(['Bash', 'PowerShell', 'exec_command']);
 function isController(command, cwd) {
   // One trusted local executable, literal arguments, no shell evaluation.
   if (/[;&|`\r\n<>$(){}]/.test(command)) return false;
-  const match = command.match(/^node\s+(?:"([^"]+)"|'([^']+)'|(\S+))\s+(start|escape|block)\b/);
-  return Boolean(match && key(path.resolve(cwd, match[1] || match[2] || match[3])) === key(path.join(__dirname, 'workflow-disposition.js')));
+  const match = command.match(/^node\s+(?:"([^"]+)"|'([^']+)'|(\S+))\s+([A-Za-z][A-Za-z0-9-]*)\b/);
+  return Boolean(match && WORKFLOW_CONTROLLER_COMMANDS.has(match[4]) &&
+    key(path.resolve(cwd, match[1] || match[2] || match[3])) === key(path.join(__dirname, 'workflow-disposition.js')));
 }
 
 function decide(payload) {

package/plugins/harness-everything/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-everything",
-  "version": "0.10.0",
+  "version": "0.11.1",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/skills/self-evolve/SKILL.md

@@ -4,7 +4,7 @@ description: "Extract root causes from resolved problems and persist them as def
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.10.0
+  version: 0.11.0
 ---
 
 # Self-evolve

package/plugins/harness-everything/skills/self-evolve/scripts/self-regression.js

@@ -42,7 +42,7 @@ function runNode(label, script, args = [], options = {}) {
 }
 
 console.log('\n[Phase 1] Static Syntax Check...');
-const foldersToScan = ['harness-everything', 'hooks', 'environment-detection', 'self-evolve', 'telemetry', 'ci', 'eval-harness', 'scripts', 'bin', 'to-spec', 'to-tickets', 'find-skills', 'fable-mode', 'multi-agent-workspace'];
+const foldersToScan = ['harness-everything', 'hooks', 'environment-detection', 'self-evolve', 'telemetry', 'contract-integrity', 'ci', 'eval-harness', 'scripts', 'bin', 'to-spec', 'to-tickets', 'find-skills', 'fable-mode', 'multi-agent-workspace'];
 const jsFiles = [];
 function walkDir(dir) {
   if (!fs.existsSync(dir)) return;
@@ -96,6 +96,7 @@ runNode('self-evolve closed loop phase 1-3', path.join(projectRoot, 'ci', 'self-
 runNode('phase 5 pre-action gate', path.join(projectRoot, 'ci', 'action-gate.test.js'));
 runNode('phase 5 platform evidence boundary', path.join(projectRoot, 'ci', 'action-gate-platform-doc.test.js'));
 runNode('cross-agent telemetry', path.join(projectRoot, 'ci', 'telemetry.test.js'));
+runNode('contract integrity phase 1', path.join(projectRoot, 'ci', 'contract-integrity.test.js'));
 runNode('issue #99 runtime correctness', path.join(projectRoot, 'ci', 'issue99-runtime.test.js'));
 
 console.log('\n[Phase 3] Skill Reference and Behavioral Case Checks...');

package/self-evolve/SKILL.md

@@ -4,7 +4,7 @@ description: "Extract root causes from resolved problems and persist them as def
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.10.0
+  version: 0.11.0
 ---
 
 # Self-evolve

package/self-evolve/scripts/self-regression.js

@@ -42,7 +42,7 @@ function runNode(label, script, args = [], options = {}) {
 }
 
 console.log('\n[Phase 1] Static Syntax Check...');
-const foldersToScan = ['harness-everything', 'hooks', 'environment-detection', 'self-evolve', 'telemetry', 'ci', 'eval-harness', 'scripts', 'bin', 'to-spec', 'to-tickets', 'find-skills', 'fable-mode', 'multi-agent-workspace'];
+const foldersToScan = ['harness-everything', 'hooks', 'environment-detection', 'self-evolve', 'telemetry', 'contract-integrity', 'ci', 'eval-harness', 'scripts', 'bin', 'to-spec', 'to-tickets', 'find-skills', 'fable-mode', 'multi-agent-workspace'];
 const jsFiles = [];
 function walkDir(dir) {
   if (!fs.existsSync(dir)) return;
@@ -96,6 +96,7 @@ runNode('self-evolve closed loop phase 1-3', path.join(projectRoot, 'ci', 'self-
 runNode('phase 5 pre-action gate', path.join(projectRoot, 'ci', 'action-gate.test.js'));
 runNode('phase 5 platform evidence boundary', path.join(projectRoot, 'ci', 'action-gate-platform-doc.test.js'));
 runNode('cross-agent telemetry', path.join(projectRoot, 'ci', 'telemetry.test.js'));
+runNode('contract integrity phase 1', path.join(projectRoot, 'ci', 'contract-integrity.test.js'));
 runNode('issue #99 runtime correctness', path.join(projectRoot, 'ci', 'issue99-runtime.test.js'));
 
 console.log('\n[Phase 3] Skill Reference and Behavioral Case Checks...');