harness-everything 0.11.5 → 0.11.7

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "harness-everything",
       "source": "./",
       "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-      "version": "0.11.5",
+      "version": "0.11.7",
       "author": {
         "name": "Miya Daniel"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-everything",
   "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-  "version": "0.11.5",
+  "version": "0.11.7",
   "author": {
     "name": "Miya Daniel"
   },

package/CHANGELOG.md

@@ -2,6 +2,38 @@
 
 All notable changes to this project are documented in this file.
 
+## [0.11.7](https://github.com/dyphn1/Harness-everything/compare/v0.11.6...v0.11.7) (2026-09-18)
+
+### Bug Fixes
+
+* Claude success path, rule-of-3 category, worktree scan ([fd8c9e7](https://github.com/dyphn1/Harness-everything/commit/fd8c9e79261a18a79883029f7179d94c18ec302e)), closes [#153](https://github.com/dyphn1/Harness-everything/issues/153) [#166](https://github.com/dyphn1/Harness-everything/issues/166) [#167](https://github.com/dyphn1/Harness-everything/issues/167) [#170](https://github.com/dyphn1/Harness-everything/issues/170)
+* fail closed on unbound host notifications ([48faf8c](https://github.com/dyphn1/Harness-everything/commit/48faf8caff38e2cc77d2eae0169d6ba62767d7de))
+* fail closed on unbound host notifications ([fea7201](https://github.com/dyphn1/Harness-everything/commit/fea72018ba74b6dc2cf6d273b4116a3503fdcda2))
+* Host notification routing and out-of-workspace edit accounting ([508a321](https://github.com/dyphn1/Harness-everything/commit/508a32141389612f8fc1c92f89ebe4fde88cee1e)), closes [#172](https://github.com/dyphn1/Harness-everything/issues/172) [#165](https://github.com/dyphn1/Harness-everything/issues/165) [#168](https://github.com/dyphn1/Harness-everything/issues/168)
+* ignore host notifications before routing ([ad355fd](https://github.com/dyphn1/Harness-everything/commit/ad355fdd98f45747b467d034adc4bf6fbcf1404b))
+* ignore host notifications before routing ([ea96577](https://github.com/dyphn1/Harness-everything/commit/ea96577d6f2916261a3a4484bfdb5358c828d475))
+* integrate Claude PostToolUse semantics ([6c3b447](https://github.com/dyphn1/Harness-everything/commit/6c3b447e7112c8a8984ad304de37c8819f17be27))
+* integrate Claude PostToolUse semantics ([a7077e9](https://github.com/dyphn1/Harness-everything/commit/a7077e9240b76a53367198c32a9d0c2645fbbc32))
+
+## [0.11.6](https://github.com/dyphn1/Harness-everything/compare/v0.11.5...v0.11.6) (2026-09-18)
+
+### Bug Fixes
+
+* **workflow:** avoid workflow rewrite after probe registration ([b9f2e06](https://github.com/dyphn1/Harness-everything/commit/b9f2e065114d70e927b6f75e7c0f7899d9e8392f))
+* **workflow:** correlate mutation probes by tool-use identity ([86cd1a1](https://github.com/dyphn1/Harness-everything/commit/86cd1a1c6eaef6518936160b0c35f94a3e652cae))
+* **workflow:** defer shell mutation accounting to observer ([c543fd0](https://github.com/dyphn1/Harness-everything/commit/c543fd0c41e18f05c21235ce4ffcf28864200940))
+* **workflow:** discard denied shell mutation probes ([7a8757c](https://github.com/dyphn1/Harness-everything/commit/7a8757cab821e524ccdd17e416e013bfbadc4f39))
+* **workflow:** fingerprint observed workspace effects ([9d8e316](https://github.com/dyphn1/Harness-everything/commit/9d8e316eb97ec7bbcd0e46ceb51491af90e57e9f))
+* **workflow:** fingerprint visible content independent of staging ([a1f370e](https://github.com/dyphn1/Harness-everything/commit/a1f370e64a97b04bee4d8df23e3ffdc7552377b8))
+* **workflow:** isolate mutation probes per tool call ([70d6052](https://github.com/dyphn1/Harness-everything/commit/70d6052ef02fce1125da9a20a14a4ad65d09ba93))
+* **workflow:** make mutation observation single-handler ordered ([ea166e1](https://github.com/dyphn1/Harness-everything/commit/ea166e1a94cdd1725cd7242feb5b0716a4dce8b8))
+* **workflow:** normalize deleted paths in fingerprint ([e5019da](https://github.com/dyphn1/Harness-everything/commit/e5019daee870e806d77d92c741a9624cd6c9bfe0))
+* **workflow:** observe shell effects before state persistence ([5271655](https://github.com/dyphn1/Harness-everything/commit/5271655627344eb71ffeb8dd36b007709862b9d0))
+* **workflow:** observe shell workspace mutations ([c547b39](https://github.com/dyphn1/Harness-everything/commit/c547b396bf2e3829b83ed03abeca594b7391f542))
+* **workflow:** remove parallel standalone mutation observer ([20027f6](https://github.com/dyphn1/Harness-everything/commit/20027f68f5b63719ea7a96a524f49c7103586644))
+* **workflow:** reserve shell mutation probes ([e7273f6](https://github.com/dyphn1/Harness-everything/commit/e7273f66010d5b0c740b87b8dbc020c8de616fe7))
+* **workflow:** settle mutation probes inside state persistence ([88feaf4](https://github.com/dyphn1/Harness-everything/commit/88feaf4ee3accbd8504b745fd4e79e548c31bd6d))
+
 ## [0.11.5](https://github.com/dyphn1/Harness-everything/compare/v0.11.4...v0.11.5) (2026-09-18)
 
 ### Bug Fixes

package/README.md

@@ -82,6 +82,7 @@ The general installer only writes to your workspace (or, with `--global`, your h
 | `AGENTS.md` + `.agents/skills/` | Codex advisory instructions plus repo-scoped Agent Skills; Hermes can also consume trusted project skills from `.agents/skills/` |
 | `.continue/rules/harness.md` + `.continue/skills/` | Continue.dev advisory rule and installer candidate skill path; standalone skill discovery is `Unknown` |
 | `.hermes.md` | Hermes Agent project advisory context |
+| `.opencode/plugins/harness-enforcement.js` (manual copy, not installer-owned) | OpenCode enforcement plugin — the general installer has no `--opencode` path; copy `opencode-plugin/index.mjs` under a `.js` name per [opencode-plugin/README.md](opencode-plugin/README.md) |
 | `.claude/harness-everything/` (or the per-platform equivalent) | Harness installer/runtime bookkeeping owned by that integration |
 
 For `--global`, the installer uses each host's supported user-level skill location rather than assuming one shared directory works everywhere: shared Agent Skills remain under `~/.agents/skills/` where natively consumed, Continue uses `~/.continue/skills/`, Hermes uses `~/.hermes/skills/`, and Claude uses `~/.claude/skills/`.
@@ -212,11 +213,14 @@ This repo uses a flat layout (waza/agentskills.io convention). The table below m
 | `plugins/harness-everything` | **Distribution** | Local OpenAI/Codex plugin package plus canonical skill copies |
 | `submission/openai` | **Distribution / Review** | Public OpenAI Skills-only listing/test inputs |
 | `evals` | **Routing Evals** | 26 trigger/routing eval suites (waza format) |
+| `eval-framework` | **Quality Gates** | Negative-control fixtures for consistency/collision gates (not a skill) |
+| `contract-integrity` | **Quality Gates** | ADR→spec→ticket→test→implementation trace audit (Phase 1; not a directly routed skill) |
+| `telemetry` | **Quality Gates** | Local JSONL operational evidence layer with report/benchmark scripts (not a skill) |
 | `behavioral-evals` | **Behavioral Evals** | LLM-level discipline cases plus weekly structural validation workflow |
 | `benchmarks` | **Benchmarks** | BENCHMARK_SOP fixtures and recorded A/B results |
 | `docs` | **Documentation** | Philosophy, architecture, routing, reflection, platform capabilities, generated repository contract, audit |
 | `references` | **Documentation** | Shared checklists (security, performance, definition-of-done) |
-| `multi-agent-workspace` | **Skill (Tier 3)** | Scaffold six zones, select agency specialists, and generate bounded launchers |
+| `multi-agent-workspace` | **Skill (Tier 3)** | Scaffold a verified multi-agent workspace and select bounded specialists from an external catalog without vendoring the full roster |
 | `environment-detection` | **Foundation** | Preflight: detect OS, shell, package manager |
 | `eval-harness` | **Skill (Tier 2)** | Evaluate agent outputs against rubrics |
 | `fable-discipline` | **Skill (Tier 3)** | Fable execution guardrails when Fable is selected |
@@ -260,7 +264,7 @@ For a deep dive into individual modules and the underlying philosophy, explore o
 
 Fable model selection is documented in [fable-mode/references/model-matrix.md](fable-mode/references/model-matrix.md); the explicit entrypoints are `fable-haiku`, `fable-sonnet`, and `fable-opus`.
 
-Maintainers should follow [RELEASING.md](RELEASING.md) for tag-driven npm releases and record observations in [docs/release-evidence.md](docs/release-evidence.md). The issue #20 coordination decisions and evidence boundaries are captured in [docs/issue-20-rollup.md](docs/issue-20-rollup.md).
+Maintainers should follow [RELEASING.md](RELEASING.md) for tag-driven npm releases and record observations in [docs/release-evidence.md](docs/release-evidence.md). Issue #20 is closed (2026-09-10); its coordination history lives in git.
 
 ---
 
@@ -294,7 +298,7 @@ Mechanism tests prove individual packaged mechanisms; only real host/session evi
 
 Harness audits itself on a dated cycle by running its own test suite and VERIFICATION.md recipes — never by reading the code and assuming it works. The full scorecards, methodology, and per-cycle change log live in [docs/audit.md](docs/audit.md). Audit scorecards are historical snapshots; current platform capability claims live in [docs/platform-capabilities.md](docs/platform-capabilities.md).
 
-**Latest local audit baseline — 2026-09-01**: 26/26 on-disk skills, 26/26 routing-eval directories, and the local npm gates were green for that audit snapshot. Waza remained a CI-only gate in that checkout because its installer was not available as an npm package; run it on an LF-normalized export as documented by CI.
+**Latest local audit baseline — 2026-09-18** (macOS, Node.js 24; see [docs/audit.md](docs/audit.md)): 26/26 on-disk skills, 26/26 routing-eval directories, 34/34 positive routes, 275/275 invariant checks, and all 26 canonical skills within the 500-token limit. Deterministic gates were green except the pre-existing `mechanism-30` failure caused by leftover `.worktrees` fixtures (reproduced on the clean tree). Waza full-matrix spec verify and live model sessions remain on-demand evidence; run waza on an LF-normalized export as documented by CI.
 
 Measure on an LF export, not a Windows working tree — CRLF can inflate waza's token counts and trigger false budget failures.
 

package/ci/mechanism-2a-rule-of-3.test.js

@@ -68,6 +68,77 @@ helper.check(
   `Got exit=${successResult.code}, state=${JSON.stringify(resetState)}`
 );
 
+helper.runHook('rule-of-3-tracker.js', claudeFailurePayload);
+const claudeNoExitSuccess = helper.runHook('rule-of-3-tracker.js', {
+  hook_event_name: 'PostToolUse',
+  tool_name: 'Bash',
+  tool_input: { command: 'echo recovered' },
+  tool_response: {
+    stdout: 'recovered',
+    stderr: 'warning: successful command emitted an error-like diagnostic',
+  },
+  session_id: helper.SESSION_ID,
+});
+const noExitResetState = helper.readState('rule-of-3-state.json');
+helper.check(
+  '2a-claude-success-no-exit. PostToolUse without exitCode resets even with stderr diagnostics',
+  claudeNoExitSuccess.code === 0 &&
+    noExitResetState.count === 0 &&
+    noExitResetState.zoomOutResolved === true,
+  `Got exit=${claudeNoExitSuccess.code}, state=${JSON.stringify(noExitResetState)}`
+);
+
+helper.writeState('rule-of-3-state.json', {
+  count: 0, lastHash: null, zoomOutResolved: false, zoomOutCycles: 0, lastFailureAt: 0,
+});
+helper.runHook('rule-of-3-tracker.js', {
+  hook_event_name: 'PostToolUseFailure',
+  tool_name: 'Bash',
+  tool_input: { command: 'diff -rq hooks cache-hooks' },
+  error: 'Exit code 1\nworkflow-mutation-denied.js\nFiles hooks/a.js and cache-hooks/a.js differ',
+  session_id: helper.SESSION_ID,
+});
+const deniedFilenameState = helper.readState('rule-of-3-state.json');
+helper.check(
+  '2a-category-negative. File name containing denied stays unknown/threshold 3',
+  deniedFilenameState.category === 'unknown' && deniedFilenameState.threshold === 3,
+  `State=${JSON.stringify(deniedFilenameState)}`
+);
+
+helper.writeState('rule-of-3-state.json', {
+  count: 0, lastHash: null, zoomOutResolved: false, zoomOutCycles: 0, lastFailureAt: 0,
+});
+helper.runHook('rule-of-3-tracker.js', {
+  hook_event_name: 'PostToolUseFailure',
+  tool_name: 'Bash',
+  tool_input: { command: 'cat protected.txt' },
+  error: 'EACCES: permission denied, open protected.txt',
+  session_id: helper.SESSION_ID,
+});
+const permissionState = helper.readState('rule-of-3-state.json');
+helper.check(
+  '2a-category-permission. Real EACCES is permission/threshold 2',
+  permissionState.category === 'permission' && permissionState.threshold === 2,
+  `State=${JSON.stringify(permissionState)}`
+);
+
+helper.writeState('rule-of-3-state.json', {
+  count: 0, lastHash: null, zoomOutResolved: false, zoomOutCycles: 0, lastFailureAt: 0,
+});
+helper.runHook('rule-of-3-tracker.js', {
+  hook_event_name: 'PostToolUseFailure',
+  tool_name: 'Bash',
+  tool_input: { command: 'node slow.js' },
+  error: 'TimeoutError: operation timed out',
+  session_id: helper.SESSION_ID,
+});
+const timeoutState = helper.readState('rule-of-3-state.json');
+helper.check(
+  '2a-category-timeout. Real timeout is timeout/threshold 2',
+  timeoutState.category === 'timeout' && timeoutState.threshold === 2,
+  `State=${JSON.stringify(timeoutState)}`
+);
+
 helper.writeState('rule-of-3-state.json', { count: 3, lastHash: 'mech-test', zoomOutResolved: false });
 const tripResult = helper.runHook('rule-of-3.js', { session_id: helper.SESSION_ID });
 helper.check(

package/ci/mechanism-2ah-workflow-lifecycle.test.js

@@ -35,6 +35,54 @@ function git(args) {
 }
 const route = prompt => node('harness-everything/scripts/kernel-router.js', { ...payload, prompt });
 const gate = (tool, input, cwd = linked) => node('hooks/scripts/workflow-gate.js', { ...payload, cwd, tool_name: tool, tool_input: input });
+const persistDirect = (tool, input, cwd = repo, response = {}) => node('hooks/scripts/state-persist.js', {
+  ...payload,
+  cwd,
+  hook_event_name: 'PostToolUse',
+  tool_name: tool,
+  tool_input: input,
+  tool_response: response,
+});
+let toolUseSeq = 0;
+function beginShell(command, cwd = repo) {
+  const toolUseId = 'toolu_fixture_' + (++toolUseSeq);
+  const input = { ...payload, cwd, tool_name: 'Bash', tool_use_id: toolUseId, tool_input: { command } };
+  return { command, cwd, toolUseId, result: node('hooks/scripts/workflow-gate.js', input) };
+}
+function persistShell(call, response = {}, hookEvent = 'PostToolUse') {
+  const input = {
+    ...payload,
+    cwd: call.cwd,
+    hook_event_name: hookEvent,
+    tool_name: 'Bash',
+    tool_use_id: call.toolUseId,
+    tool_input: { command: call.command },
+  };
+  if (hookEvent === 'PostToolUseFailure') {
+    input.error = response.error || 'Exit code 1\nfixture failure';
+    input.is_interrupt = Boolean(response.is_interrupt);
+  } else {
+    input.tool_response = response;
+  }
+  return node('hooks/scripts/state-persist.js', input);
+}
+function denyShell(call) {
+  return node('hooks/scripts/workflow-mutation-denied.js', {
+    ...payload,
+    cwd: call.cwd,
+    hook_event_name: 'PermissionDenied',
+    permission_mode: 'auto',
+    tool_name: 'Bash',
+    tool_use_id: call.toolUseId,
+    tool_input: { command: call.command },
+    reason: 'Blocked by classifier',
+  });
+}
+const probeDir = path.join(sessionDir, 'mutation-probes');
+const probeFiles = () => {
+  try { return fs.readdirSync(probeDir).filter(name => /^[a-f0-9]{64}\.json$/.test(name)); }
+  catch (_) { return []; }
+};
 const stop = extra => node('hooks/scripts/workflow-stop-gate.js', { ...payload, ...extra });
 const control = (...args) => node('hooks/scripts/workflow-disposition.js', null, [args[0], '--session-id', sessionId, ...args.slice(1)]);
 const stages = [
@@ -47,6 +95,20 @@ try {
   git(['init']); fs.writeFileSync(path.join(repo, 'README.md'), 'fixture\n'); git(['add', '.']);
   git(['-c', 'user.name=Harness Test', '-c', 'user.email=harness@example.invalid', 'commit', '-m', 'fixture']);
   git(['worktree', 'add', linked, '-b', 'isolated']);
+  const taskNotification = '<task-notification><summary>Background command "Run full test suite" failed with exit code 1</summary></task-notification>';
+  const unboundNotification = node('harness-everything/scripts/kernel-router.js', { cwd: repo, prompt: taskNotification });
+  check(unboundNotification.status === 0 &&
+    unboundNotification.stdout.includes('ignored for routing') &&
+    !unboundNotification.stdout.includes('WORKFLOW EXECUTION CONTRACT'),
+    'host notification without session binding is a routing no-op');
+  const noWorkflowNotification = route(taskNotification);
+  check(noWorkflowNotification.status === 0 && !fs.existsSync(file),
+    'host notification with no active workflow creates no contract');
+  check(noWorkflowNotification.stdout.includes('ignored for routing') &&
+    !noWorkflowNotification.stdout.includes('iterative-single') &&
+    !noWorkflowNotification.stdout.includes('WORKFLOW EXECUTION CONTRACT'),
+    'host notification with no active workflow emits no notification-derived routing contract');
+
   const routed = route('Refactor the entire repository architecture in dependent stages.');
   check(routed.status === 0, 'prompt hook creates workflow');
   const initial = read(file);
@@ -109,6 +171,15 @@ try {
   check(stop().status === 2, 'verification predating a new mutation is stale');
   write(file, mutationState);
   check(stop().status === 0 && read(file).state === 'satisfied', 'all covered stages and verifier resolve workflow to satisfied');
+  const satisfiedWorkflow = read(file);
+  const satisfiedNotification = route(taskNotification);
+  check(satisfiedNotification.status === 0 &&
+    read(file).workflowId === satisfiedWorkflow.workflowId &&
+    read(file).state === 'satisfied',
+    'satisfied workflow followed by host notification keeps the same satisfied contract');
+  check(!satisfiedNotification.stdout.includes('Run full test suite') &&
+    satisfiedNotification.stdout.includes('routing unchanged'),
+    'satisfied host notification text is not routed as new work');
   check(route('Refactor the entire repository architecture in dependent stages.').status === 0 && read(file).workflowId !== initial.workflowId, 'next completed-task boundary creates a fresh workflow');
   check(stop({ stop_hook_active: true }).status === 0 && read(file).state === 'blocked', 'Stop retry reports blocked instead of faking completion');
   check(gate('Write', { file_path: path.join(linked, 'src.js') }).status === 2, 'blocked state still prohibits mutation');
@@ -156,9 +227,117 @@ try {
   check(gate('Write', { file_path: path.join(repo, 'premature-primary.js') }, repo).status === 2, 'activated Tier 3 plan still blocks primary-tree mutation');
   fs.unlinkSync(file);
   check(route('Fix this checkout bug with a regression test').status === 0 && read(file).strategy === 'iterative-single', 'fresh bounded fix returns to Tier 2 iterative lifecycle');
+  let tier2 = read(file);
+  const tier2WorkflowId = tier2.workflowId;
+  write(file, { ...tier2, state: 'deferred' });
+  const deferredNotification = route(taskNotification);
+  check(deferredNotification.status === 0 &&
+    read(file).workflowId === tier2WorkflowId &&
+    read(file).state === 'deferred',
+    'deferred workflow followed by host notification keeps the same deferred contract');
+  check(!deferredNotification.stdout.includes('Run full test suite') &&
+    deferredNotification.stdout.includes('routing unchanged'),
+    'deferred host notification text is not routed as new work');
+  write(file, tier2);
+
   const iterationLimit = read(file).workflowPlan.limits.maxIterations;
   check(Number.isInteger(iterationLimit) && iterationLimit > 0, 'iterative route exposes a numeric iteration budget');
 
+  // #165: direct Edit/Write/apply_patch accounting follows workspace effects.
+  // Bookkeeping outside the repository must not consume Tier-2 iterations or
+  // advance workflow/Stop-gate mutation milestones.
+  const handoffFile = path.join(sessionDir, 'handoff-state.json');
+  const outsideTarget = path.join(temp, 'scratch-note.txt');
+  const beforeOutside = read(file);
+  const beforeOutsideIterations = beforeOutside.budget?.counters?.iterations || 0;
+  const beforeOutsideMutationAt = beforeOutside.lastMutationAt || 0;
+  const beforeOutsideEditAt = fs.existsSync(handoffFile) ? (read(handoffFile).lastEditAt || 0) : 0;
+  for (let i = 0; i < 3; i++) {
+    check(gate('Write', { file_path: outsideTarget }, repo).status === 0,
+      'out-of-workspace Write is admitted without Tier-2 mutation accounting');
+    fs.writeFileSync(outsideTarget, 'scratch ' + i + '\n');
+    const outsideResponse = i === 0
+      ? { stderr: 'warning: successful bookkeeping write emitted diagnostic text' }
+      : {};
+    check(persistDirect('Write', { file_path: outsideTarget }, repo, outsideResponse).status === 0,
+      'out-of-workspace Write post-tool state persists without mutation milestone');
+  }
+  const afterOutside = read(file);
+  const afterOutsideHandoff = read(handoffFile);
+  check((afterOutside.budget?.counters?.iterations || 0) === beforeOutsideIterations &&
+    (afterOutside.lastMutationAt || 0) === beforeOutsideMutationAt &&
+    (afterOutsideHandoff.lastEditAt || 0) === beforeOutsideEditAt &&
+    afterOutsideHandoff.status !== 'failed',
+    'out-of-workspace Writes leave iterations/milestones unchanged and PostToolUse stderr is not a failure');
+  check(stop().status === 0, 'out-of-workspace-only bookkeeping does not force verification before Stop');
+
+  check(route('Fix this checkout bug with a regression test').status === 0 && read(file).strategy === 'iterative-single',
+    'real follow-up user prompt after notification/accounting checks routes normally');
+  let observedDirectIterations = read(file).budget?.counters?.iterations || 0;
+  const internalTarget = path.join(repo, 'direct-inside.txt');
+  const beforeInternalMutationAt = read(file).lastMutationAt || 0;
+  check(gate('Write', { file_path: internalTarget }, repo).status === 0, 'in-workspace Write is admitted');
+  fs.writeFileSync(internalTarget, 'inside\n');
+  check(persistDirect('Write', { file_path: internalTarget }, repo).status === 0, 'in-workspace Write post-tool state persists');
+  check(read(file).budget.counters.iterations === ++observedDirectIterations &&
+    read(file).lastMutationAt >= beforeInternalMutationAt &&
+    read(handoffFile).lastEditAt > beforeOutsideEditAt,
+    'in-workspace Write consumes exactly one iteration and advances mutation milestones');
+
+  const mixedPatch = [
+    '*** Begin Patch',
+    `*** Update File: ${outsideTarget}`,
+    '@@',
+    '-scratch',
+    '+scratch updated',
+    `*** Update File: ${path.join(repo, 'README.md')}`,
+    '@@',
+    '-fixture',
+    '+fixture updated',
+    '*** End Patch',
+  ].join('\n');
+  check(gate('apply_patch', { patch: mixedPatch }, repo).status === 0, 'mixed apply_patch is admitted');
+  check(persistDirect('apply_patch', { patch: mixedPatch }, repo).status === 0, 'mixed apply_patch post-tool state persists');
+  check(read(file).budget.counters.iterations === ++observedDirectIterations,
+    'mixed apply_patch counts exactly once when any target is inside the workspace');
+
+  const pureOutsidePatch = [
+    '*** Begin Patch',
+    `*** Update File: ${outsideTarget}`,
+    '@@',
+    '-scratch updated',
+    '+scratch external only',
+    '*** End Patch',
+  ].join('\n');
+  const beforePureOutside = read(file);
+  const beforePureOutsideEditAt = read(handoffFile).lastEditAt || 0;
+  check(gate('apply_patch', { patch: pureOutsidePatch }, repo).status === 0, 'pure external apply_patch is admitted');
+  check(persistDirect('apply_patch', { patch: pureOutsidePatch }, repo).status === 0, 'pure external apply_patch post-tool state persists');
+  check(read(file).budget.counters.iterations === observedDirectIterations &&
+    read(file).lastMutationAt === beforePureOutside.lastMutationAt &&
+    (read(handoffFile).lastEditAt || 0) === beforePureOutsideEditAt,
+    'pure external apply_patch consumes no iteration and advances no mutation milestone');
+
+  const linkedTarget = path.join(linked, 'direct-linked.txt');
+  check(gate('Write', { file_path: linkedTarget }, linked).status === 0,
+    'Write inside a linked worktree is treated as workspace mutation');
+  fs.writeFileSync(linkedTarget, 'linked\n');
+  check(persistDirect('Write', { file_path: linkedTarget }, linked).status === 0,
+    'linked-worktree Write post-tool state persists');
+  check(read(file).budget.counters.iterations === ++observedDirectIterations,
+    'linked-worktree Write consumes exactly one iteration');
+
+  // Keep the #165 regression fixture from consuming the budget used by the
+  // pre-existing lifecycle/exhaustion assertions below.
+  fs.unlinkSync(internalTarget);
+  fs.unlinkSync(linkedTarget);
+  fs.unlinkSync(file);
+  if (fs.existsSync(handoffFile)) fs.unlinkSync(handoffFile);
+  check(route('Fix this checkout bug with a regression test').status === 0 &&
+    read(file).strategy === 'iterative-single' &&
+    (read(file).budget?.counters?.iterations || 0) === 0,
+    '#165 regression fixture resets into a fresh Tier-2 lifecycle baseline');
+
   // #155/#157 regression lock: read-only shell composition, including quoted
   // and escaped separator characters inside arguments, must never look like an
   // iterative mutation or advance the mutation clock.
@@ -183,10 +362,132 @@ try {
   check((afterReadOnly.lastMutationAt || 0) === readOnlyMutationAt,
     'read-only shell composition does not advance lastMutationAt');
 
-  for (let i = 0; i < iterationLimit; i++) {
-    check(gate('Write', { file_path: path.join(repo, `small-${i}.js`) }, repo).status === 0, `iterative mutation ${i + 1}/${iterationLimit} stays within budget`);
+  // #159: safety classification is not mutation evidence. Commands that are
+  // not proven read-only are admitted under an opaque workspace probe while
+  // capacity remains, then accounted only if the visible workspace changed.
+  const untrustedReads = [
+    'git fetch origin --quiet 2>&1; git status; git log --oneline -1',
+    'git remote -v',
+    'gh run view 1 --json status',
+    'node -e "console.log(42)"',
+  ];
+  for (const command of untrustedReads) {
+    const before = read(file);
+    const call = beginShell(command);
+    check(call.result.status === 0, 'untrusted read/query is admitted under observation: ' + command);
+    const probes = probeFiles();
+    check(probes.length === 1 && !fs.readFileSync(path.join(probeDir, probes[0]), 'utf8').includes(command),
+      'mutation probe persists only opaque identity, not raw command text');
+    check(persistShell(call).status === 0, 'no-effect shell probe resolves through state-persist: ' + command);
+    check(probeFiles().length === 0, 'completed shell call removes its mutation probe');
+    const after = read(file);
+    check((after.budget?.counters?.iterations || 0) === (before.budget?.counters?.iterations || 0),
+      'no-effect untrusted shell command consumes no iteration');
+    check((after.lastMutationAt || 0) === (before.lastMutationAt || 0),
+      'no-effect untrusted shell command does not advance lastMutationAt');
+  }
+
+  const deniedCall = beginShell('node denied-by-auto-mode.js');
+  check(deniedCall.result.status === 0 && probeFiles().length === 1,
+    'auto-mode candidate reserves mutation capacity before permission decision');
+  check(denyShell(deniedCall).status === 0 && probeFiles().length === 0,
+    'PermissionDenied releases the exact tool-use mutation probe');
+  const parallelA = beginShell('node repeated-read-only-wrapper.js');
+  const parallelB = beginShell('node repeated-read-only-wrapper.js');
+  check(parallelA.result.status === 0 && parallelB.result.status === 0 && probeFiles().length === 2,
+    'identical concurrent shell commands receive distinct tool-use probes');
+  check(denyShell(parallelA).status === 0 && persistShell(parallelB).status === 0 && probeFiles().length === 0,
+    'parallel tool-use probes settle independently without reservation leakage');
+
+  const metadataFetch = 'git fetch . HEAD:refs/remotes/origin/harness-probe';
+  const beforeMetadataFetch = read(file);
+  const metadataFetchCall = beginShell(metadataFetch);
+  check(metadataFetchCall.result.status === 0,
+    'metadata-only git fetch is admitted under observation');
+  git(['fetch', '.', 'HEAD:refs/remotes/origin/harness-probe']);
+  check(persistShell(metadataFetchCall).status === 0, 'real metadata-only git fetch probe resolves');
+  check((read(file).budget?.counters?.iterations || 0) === (beforeMetadataFetch.budget?.counters?.iterations || 0) &&
+    (read(file).lastMutationAt || 0) === (beforeMetadataFetch.lastMutationAt || 0),
+    'real git fetch changes Git metadata without consuming a code iteration');
+
+  let observedIterations = read(file).budget?.counters?.iterations || 0;
+  const mutateTracked = 'node mutate-tracked.js';
+  const mutateTrackedCall = beginShell(mutateTracked);
+  check(mutateTrackedCall.result.status === 0, 'unknown tracked-file mutator is admitted under observation');
+  fs.writeFileSync(path.join(repo, 'README.md'), 'fixture changed once\n');
+  check(persistShell(mutateTrackedCall).status === 0, 'tracked-file mutation is observed');
+  check(read(file).budget.counters.iterations === ++observedIterations, 'tracked-file mutation consumes exactly one iteration');
+  const firstObservedAt = read(file).lastMutationAt;
+
+  const mutateDirty = 'node mutate-dirty-again.js';
+  const mutateDirtyCall = beginShell(mutateDirty);
+  check(mutateDirtyCall.result.status === 0, 'unknown already-dirty mutator is admitted under observation');
+  fs.writeFileSync(path.join(repo, 'README.md'), 'fixture changed twice\n');
+  check(persistShell(mutateDirtyCall).status === 0, 'already-dirty content change is observed');
+  check(read(file).budget.counters.iterations === ++observedIterations && read(file).lastMutationAt >= firstObservedAt,
+    'already-dirty content change consumes one new iteration');
+
+  const createUntracked = 'node create-untracked.js';
+  const createUntrackedCall = beginShell(createUntracked);
+  check(createUntrackedCall.result.status === 0, 'unknown untracked-file mutator is admitted under observation');
+  fs.writeFileSync(path.join(repo, 'observed-untracked.txt'), 'one\n');
+  check(persistShell(createUntrackedCall).status === 0, 'untracked-file creation is observed');
+  check(read(file).budget.counters.iterations === ++observedIterations, 'untracked-file creation consumes exactly one iteration');
+
+  const failedMutation = 'node fail-after-write.js';
+  const failedMutationCall = beginShell(failedMutation);
+  check(failedMutationCall.result.status === 0, 'failing shell mutator is admitted under observation');
+  fs.writeFileSync(path.join(repo, 'observed-failed.txt'), 'written before failure\n');
+  check(persistShell(failedMutationCall, { error: 'Exit code 7\nfixture failure' }, 'PostToolUseFailure').status === 0,
+    'failed shell command still reports workspace mutation through failure lifecycle');
+  check(read(file).budget.counters.iterations === ++observedIterations,
+    'failed shell command that changed workspace still consumes one iteration');
+
+  const beforeStageOnly = read(file);
+  const stageOnly = 'git add README.md observed-untracked.txt';
+  const stageOnlyCall = beginShell(stageOnly);
+  check(stageOnlyCall.result.status === 0, 'staging-only git command is observed instead of pre-counted');
+  git(['add', 'README.md', 'observed-untracked.txt']);
+  check(persistShell(stageOnlyCall).status === 0, 'staging-only probe resolves');
+  check(read(file).budget.counters.iterations === beforeStageOnly.budget.counters.iterations,
+    'git add does not double-count tracked or previously-untracked visible content');
+
+  const beforeCommitOnly = read(file);
+  const commitOnly = 'git commit -m observed-fixture';
+  const commitOnlyCall = beginShell(commitOnly);
+  check(commitOnlyCall.result.status === 0, 'pure commit is observed instead of pre-counted');
+  git(['-c', 'user.name=Harness Test', '-c', 'user.email=harness@example.invalid', 'commit', '-m', 'observed-fixture']);
+  check(persistShell(commitOnlyCall).status === 0, 'pure commit probe resolves');
+  check(read(file).budget.counters.iterations === beforeCommitOnly.budget.counters.iterations,
+    'pure commit of already-accounted content does not consume another code iteration');
+
+  const deleteTracked = 'node delete-tracked.js';
+  const deleteTrackedCall = beginShell(deleteTracked);
+  check(deleteTrackedCall.result.status === 0, 'unknown tracked-file deletion is admitted under observation');
+  fs.unlinkSync(path.join(repo, 'observed-untracked.txt'));
+  check(persistShell(deleteTrackedCall).status === 0, 'tracked-file deletion is observed');
+  check(read(file).budget.counters.iterations === ++observedIterations,
+    'tracked-file deletion consumes exactly one iteration');
+
+  const beforeStageDelete = read(file);
+  const stageDelete = 'git add -u observed-untracked.txt';
+  const stageDeleteCall = beginShell(stageDelete);
+  check(stageDeleteCall.result.status === 0, 'staging-only deletion is observed instead of pre-counted');
+  git(['add', '-u', 'observed-untracked.txt']);
+  check(persistShell(stageDeleteCall).status === 0, 'staging deletion probe resolves');
+  check(read(file).budget.counters.iterations === beforeStageDelete.budget.counters.iterations,
+    'git add -u does not double-count an already-observed deletion');
+
+  observedIterations = read(file).budget.counters.iterations;
+  for (let i = observedIterations; i < iterationLimit; i++) {
+    check(gate('Write', { file_path: path.join(repo, `small-${i}.js`) }, repo).status === 0, `confirmed mutation ${i + 1}/${iterationLimit} stays within budget`);
   }
-  check(gate('Write', { file_path: path.join(repo, 'small-overflow.js') }, repo).status === 2, 'iteration beyond maxIterations is blocked');
+  check(gate('Bash', { command: 'git status --short' }, repo).status === 0,
+    'proven read-only diagnosis remains allowed at the iteration limit');
+  check(gate('Bash', { command: 'git remote -v' }, repo).status === 2,
+    'untrusted shell command is blocked before execution once actual mutation budget is full');
+  check(gate('Write', { file_path: path.join(repo, 'small-overflow.js') }, repo).status === 2,
+    'blocked exhausted workflow still rejects direct mutation');
   const iterativeExhausted = read(file);
   check(iterativeExhausted.state === 'blocked' && iterativeExhausted.budget?.state === 'budget-exhausted' &&
     iterativeExhausted.budget?.reasonCode === 'iteration-budget-exhausted', 'iterative exhaustion records blocked budget state');
@@ -200,11 +501,16 @@ try {
   check(stop().status === 2, 'direct/iterative route cannot complete unverified mutation');
   check(stop({ stop_hook_active: true }).status === 0 && read(file).state === 'blocked', 'iterative retry reports incomplete state');
   check(control('start').status === 0, 'blocked iterative route can resume without a Fable stage map');
-  // Issue #153: a host is not guaranteed to report a numeric exit code at
-  // all (state-persist.js's own isFailed logic already treats "no exit code
-  // and no stderr" as success), so this must resolve rather than deadlock.
-  node('hooks/scripts/state-persist.js', { ...payload, tool_name: 'Bash', tool_input: { command: 'npm test' }, tool_response: { stdout: 'no code' } });
-  check(stop().status === 0 && read(file).state === 'satisfied', 'verification without a host-reported numeric exit status still resolves completion');
+  // #153 + #159 ordering: when one shell command mutates and then verifies,
+  // observed mutation must land before state-persist records verification.
+  const mutateAndVerify = 'node mutate.js && npm test';
+  const mutateAndVerifyCall = beginShell(mutateAndVerify);
+  check(mutateAndVerifyCall.result.status === 0, 'combined mutation+verification command is admitted under observation');
+  fs.writeFileSync(path.join(repo, 'README.md'), 'fixture verified mutation\n');
+  check(persistShell(mutateAndVerifyCall, { stdout: 'tests passed' }).status === 0,
+    'single state-persist handler records mutation before verification');
+  check(stop().status === 0 && read(file).state === 'satisfied',
+    'verification without a host-reported numeric exit status resolves after same-command mutation');
   node('hooks/scripts/state-persist.js', { ...payload, tool_name: 'Bash', tool_input: { command: 'npm test' }, tool_response: { exitCode: 0, stdout: 'passed' } });
   check(stop().status === 0 && read(file).state === 'satisfied', 'observed iterative verification resolves completion');
   console.log(`PASS: workflow lifecycle (${passed} assertions)`);

package/ci/mechanism-2c-state-persist.test.js

@@ -16,14 +16,57 @@ helper.check(
 
 helper.runHook('state-persist.js', {
   session_id: helper.SESSION_ID,
+  hook_event_name: 'PostToolUse',
   tool_name: 'Bash',
-  tool_response: { stdout: 'ok', exitCode: 0 },
+  tool_response: {
+    stdout: 'ok',
+    stderr: 'warning: successful command emitted diagnostic text',
+  },
 });
 const resolvedHandoff = helper.readState('handoff-state.json');
 helper.check(
-  '2c. A subsequent successful command clears status back to idle',
+  '2c. Claude-shaped PostToolUse without exitCode clears failed state even with stderr diagnostics',
   resolvedHandoff.status === 'idle' && !!resolvedHandoff.lastResolved,
   `Got ${JSON.stringify(resolvedHandoff)}`
 );
 
+helper.runHook('state-persist.js', {
+  session_id: helper.SESSION_ID,
+  hook_event_name: 'PostToolUse',
+  tool_name: 'Bash',
+  tool_response: { stdout: '', stderr: 'numeric failure', exitCode: 2 },
+});
+const numericFailure = helper.readState('handoff-state.json');
+helper.check(
+  '2c. Numeric non-zero exit still records failure on hosts that report exit codes',
+  numericFailure.status === 'failed' && numericFailure.exitCode === 2,
+  `Got ${JSON.stringify(numericFailure)}`
+);
+
+helper.runHook('state-persist.js', {
+  session_id: helper.SESSION_ID,
+  hook_event_name: 'PostToolUse',
+  tool_name: 'Bash',
+  tool_response: { stdout: 'ok', exitCode: 0 },
+});
+const numericResolved = helper.readState('handoff-state.json');
+helper.check(
+  '2c. Numeric zero exit still clears failure state',
+  numericResolved.status === 'idle' && !!numericResolved.lastResolved,
+  `Got ${JSON.stringify(numericResolved)}`
+);
+
+helper.runHook('state-persist.js', {
+  session_id: helper.SESSION_ID,
+  hook_event_name: 'PostToolUseFailure',
+  tool_name: 'Bash',
+  error: 'host-declared failure without numeric exit code',
+});
+const eventFailure = helper.readState('handoff-state.json');
+helper.check(
+  '2c. PostToolUseFailure remains authoritative without numeric exitCode',
+  eventFailure.status === 'failed',
+  `Got ${JSON.stringify(eventFailure)}`
+);
+
 helper.finish();

package/ci/mechanism-2t-issue-20.test.js

@@ -64,12 +64,4 @@ helper.check(
   `exit ${negativeControls.status}\n${negativeControls.stdout}\n${negativeControls.stderr}`
 );
 
-const rollup = fs.readFileSync(path.join(helper.root, 'docs', 'issue-20-rollup.md'), 'utf8');
-const deferredWork = ['baseline-debugging', 'baseline-performance', 'baseline-security-review', 'baseline-simple-bugfix', 'verify-before-done', 'verification-loop', 'zoom-out', 'security-review'];
-helper.check(
-  '2t. issue rollup records unresolved acceptance work accurately',
-  /Issue #20 remains open/.test(rollup) && deferredWork.every(term => rollup.includes(term)),
-  'rollup must name the open issue and each deferred baseline/skill item'
-);
-
 helper.finish();