harness-everything 0.11.5 → 0.11.7

package/plugins/harness-everything/hooks/scripts/state-persist.js

@@ -2,6 +2,8 @@
 const fs = require('fs');
 const path = require('path');
 const { getWorkspaceRoot, getSessionDir } = require('./lib/harness-state');
+const { loadWorkflow, saveWorkflow, peekMutationProbe, settleMutationProbe } = require('./lib/workflow-runtime');
+const { cwdOf, shellProbeKey, workspaceFingerprint, directMutationInWorkspace } = require('./lib/workflow-isolation');
 const { observeTool } = require('./lib/telemetry');
 
 // Commands that count as "verification ran" for the Stop gate
@@ -28,7 +30,31 @@ process.stdin.on('end', () => {
   }
 });
 
+function observeWorkspaceMutation(payload, root) {
+  const toolName = payload && (payload.tool_name || payload.tool);
+  if (toolName !== 'Bash' && toolName !== 'PowerShell' && toolName !== 'exec_command') return false;
+  const context = loadWorkflow(payload);
+  if (!context.workflow || context.workflow.state === 'deferred') return false;
+  const cwd = cwdOf(payload, root);
+  const probeKey = shellProbeKey(payload, cwd);
+  if (!peekMutationProbe(context, probeKey)) return false;
+  let after;
+  try {
+    after = workspaceFingerprint(cwd);
+  } catch (error) {
+    context.workflow.state = 'blocked';
+    context.workflow.blockReason = 'mutation-observation-failed';
+    saveWorkflow(context);
+    const critical = new Error('cannot verify whether shell execution changed workspace content');
+    critical.code = 'HARNESS_MUTATION_OBSERVATION';
+    throw critical;
+  }
+  const result = settleMutationProbe(context, probeKey, after, toolName);
+  return Boolean(result && result.changed);
+}
+
 function processState(payload) {
+  let exitCodeForHook = 0;
   try {
     const sessionId = payload && (payload.session_id || payload.sessionId);
     const root = getWorkspaceRoot(payload);
@@ -48,12 +74,17 @@ function processState(payload) {
       // it's actually a number; fall back to a stderr signal otherwise.
       const toolResponse = payload.tool_response || {};
       const stdout = toolResponse.stdout ?? payload.stdout ?? '';
-      const stderr = toolResponse.stderr ?? payload.stderr ?? '';
+      const stderr = toolResponse.stderr ?? payload.stderr ?? payload.error ?? '';
       const rawExitCode = toolResponse.exitCode ?? toolResponse.exit_code ?? payload.exitCode;
       const exitCode = typeof rawExitCode === 'number' ? rawExitCode : undefined;
       const stderrSignal = typeof stderr === 'string' && stderr.trim().length > 0;
-      const isFailed = (exitCode !== undefined && exitCode !== 0) || (exitCode === undefined && stderrSignal);
+      const hookEvent = payload.hook_event_name || payload.hookEventName || '';
+      const isSuccessEvent = hookEvent === 'PostToolUse';
+      const isFailed = hookEvent === 'PostToolUseFailure' ||
+        (exitCode !== undefined && exitCode !== 0) ||
+        (!isSuccessEvent && exitCode === undefined && stderrSignal);
       const toolName = payload.tool_name || payload.tool || 'command';
+      const observedMutation = observeWorkspaceMutation(payload, root);
 
       if (isFailed) {
         // Truncate output to avoid state bloat
@@ -67,8 +98,13 @@ function processState(payload) {
         state.tool = toolName;
         state.exitCode = exitCode;
         state.errorSummary = output.trim();
-      } else if (exitCode === 0 && state.status === 'failed') {
-        // Clear failed state or mark as idle/resolved
+      } else if (!isFailed && state.status === 'failed') {
+        // Clear failed state or mark as idle/resolved.
+        // NOTE (#166, follows #153): Claude Code Bash PostToolUse payloads
+        // carry no numeric exit code, so `exitCode === 0` never holds there.
+        // A PostToolUse event with no numeric non-zero exit status counts as
+        // success even when stderr contains diagnostics. Hosts that omit the
+        // lifecycle event name retain the conservative stderr fallback.
         state.lastResolved = { tool: state.tool, timestamp: state.timestamp };
         state.status = 'idle';
         state.timestamp = new Date().toISOString();
@@ -77,10 +113,13 @@ function processState(payload) {
       }
 
       // Milestones for the Stop gate: when did the last mutation happen, and
-      // has any verification-ish command succeeded since.
-      if (toolName === 'Edit' || toolName === 'Write' || toolName === 'apply_patch') {
+      // has any verification-ish command succeeded since. Direct-tool edits
+      // outside the workspace advance neither milestone (#165).
+      const isDirectTool = toolName === 'Edit' || toolName === 'Write' || toolName === 'apply_patch';
+      if ((isDirectTool && directMutationInWorkspace(payload, cwdOf(payload, root), root)) || observedMutation) {
         state.lastEditAt = Date.now();
-      } else if ((toolName === 'Bash' || toolName === 'PowerShell') && !isFailed) {
+      }
+      if ((toolName === 'Bash' || toolName === 'PowerShell') && !isFailed) {
         const command = (payload.tool_input && payload.tool_input.command) || '';
         if (VERIFY_COMMAND_RE.test(command)) {
           state.lastVerifyAt = Date.now();
@@ -100,7 +139,11 @@ function processState(payload) {
       }
     }
   } catch (err) {
-    // Fail silently in hooks
+    if (err && (err.code === 'HARNESS_MUTATION_OBSERVATION' || err.code === 'HARNESS_WORKFLOW_BUDGET')) {
+      console.error('[State Persist] ' + err.message);
+      exitCodeForHook = 2;
+    }
+    // Non-critical persistence/telemetry failures remain fail-open.
   }
-  process.exit(0);
+  process.exit(exitCodeForHook);
 }

package/plugins/harness-everything/hooks/scripts/workflow-gate.js

@@ -3,8 +3,8 @@
 
 const path = require('path');
 const fs = require('fs');
-const { loadWorkflow, saveWorkflow, isMajorWorkflow, matchingRun, recordBudgetEvent, readHookInput, WORKFLOW_CONTROLLER_COMMANDS } = require('./lib/workflow-runtime');
-const { key, classifyShell, cwdOf, commandOf, mutationPaths, linkedWorktree, assertTargets, assertShellScope } = require('./lib/workflow-isolation');
+const { loadWorkflow, saveWorkflow, isMajorWorkflow, matchingRun, registerMutationProbe, recordBudgetEvent, readHookInput, WORKFLOW_CONTROLLER_COMMANDS } = require('./lib/workflow-runtime');
+const { key, classifyShell, workspaceFingerprint, shellProbeKey, cwdOf, commandOf, mutationPaths, directMutationInWorkspace, linkedWorktree, assertTargets, assertShellScope } = require('./lib/workflow-isolation');
 
 const DIRECT = new Set(['Edit', 'Write', 'apply_patch']);
 const SHELL = new Set(['Bash', 'PowerShell', 'exec_command']);
@@ -27,8 +27,8 @@ function decide(payload) {
   const cwd = cwdOf(payload, root);
   const command = commandOf(payload);
   const commandClass = SHELL.has(tool) ? classifyShell(command) : 'direct-mutation';
-  if (commandClass === 'read-only' || commandClass === 'worktree-setup') return;
   if (SHELL.has(tool) && isController(command, cwd)) return;
+  if (commandClass === 'read-only' || commandClass === 'worktree-setup') return;
   // Only the stage specification is allowed before run entry. Other runtime
   // state, including workflow-run.json, cannot use this bootstrap exception.
   const targets = DIRECT.has(tool) ? mutationPaths(payload) : [];
@@ -47,11 +47,26 @@ function decide(payload) {
   if (String(workflow.strategy || '').startsWith('fable-') && !matchingRun(context)) {
     throw new Error('selected Fable workflow has no correlated run. Write workflow-stages.json at the displayed session path, then use workflow-disposition.js start.');
   }
-  if (workflow.strategy === 'iterative-single') {
-    recordBudgetEvent(context, 'iteration', { evidence: `${tool}:${commandClass}` });
+  if (DIRECT.has(tool)) {
+    // Bookkeeping outside the workspace (scratchpad, memory files, temp
+    // notes) is not a workspace mutation: it consumes no Tier-2 iteration
+    // and advances no mutation milestone (#165).
+    if (!directMutationInWorkspace(payload, cwd, root)) return;
+    if (workflow.strategy === 'iterative-single') {
+      recordBudgetEvent(context, 'iteration', { evidence: `${tool}:direct-mutation` });
+    }
+    workflow.lastMutationAt = Date.now();
+    saveWorkflow(context);
+    return;
   }
-  workflow.lastMutationAt = Date.now();
-  saveWorkflow(context);
+
+  // Shell safety and shell mutation accounting are intentionally separate.
+  // `untrusted` means "not proven read-only", not "a mutation occurred".
+  // Capture an opaque pre-execution workspace fingerprint; the post-tool
+  // observer consumes an iteration only when workspace content actually changed.
+  const fingerprint = workspaceFingerprint(cwd);
+  const probeKey = shellProbeKey(payload, cwd);
+  registerMutationProbe(context, probeKey, fingerprint, workflow.strategy === 'iterative-single');
 }
 
 readHookInput(decide);

package/plugins/harness-everything/hooks/scripts/workflow-mutation-denied.js

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+'use strict';
+
+const { loadWorkflow, discardMutationProbe, readHookInput } = require('./lib/workflow-runtime');
+const { cwdOf, shellProbeKey } = require('./lib/workflow-isolation');
+
+function discardDenied(payload) {
+  if (!payload) return;
+  const tool = payload.tool_name || payload.tool;
+  if (tool !== 'Bash' && tool !== 'PowerShell' && tool !== 'exec_command') return;
+  const context = loadWorkflow(payload);
+  if (!context.workflow || context.workflow.state === 'deferred') return;
+  const cwd = cwdOf(payload, context.root);
+  discardMutationProbe(context, shellProbeKey(payload, cwd));
+}
+
+readHookInput(discardDenied);

package/plugins/harness-everything/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-everything",
-  "version": "0.11.5",
+  "version": "0.11.7",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/skills/harness-everything/SKILL.md

@@ -4,7 +4,7 @@ description: "Route software/project work through the Harness kernel: classify T
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.11.2
+  version: 0.11.7
 ---
 
 # Harness Everything

package/plugins/harness-everything/skills/harness-everything/scripts/kernel-router.js

@@ -33,12 +33,26 @@ function issueMemoryCapability(workflow) {
   return token;
 }
 
+// Host-generated background-task notifications arrive as UserPromptSubmit
+// hook payloads but are not user input (#168). Routing them like prompts
+// replaces the workflow contract mid-turn (e.g. deferred -> a new Tier-2).
+// A prompt that is entirely a notification envelope must never create or
+// replace a workflow; the current contract is kept unchanged.
+function isHostNotificationPrompt(prompt) {
+  const text = String(prompt || '').trim();
+  if (!text) return false;
+  return /^<task-notification[\s>][\s\S]*<\/task-notification>\s*$/i.test(text);
+}
+
 function persistWorkflow(plan, payload, prompt) {
   if (!payload || !(payload.session_id || payload.sessionId)) return null;
   const { runtime, hooksRoot } = loadRuntime();
   const context = runtime.loadWorkflow(payload);
   const { writeCurrentSession } = require(path.join(hooksRoot, 'lib/harness-state'));
   writeCurrentSession(context.root, context.sessionId);
+  if (isHostNotificationPrompt(prompt)) {
+    return { ...context, hooksRoot, retained: true, hostNotification: true };
+  }
   if (context.workflow && runtime.OPEN_STATES.has(context.workflow.state)) {
     if (!context.workflow.workflowPlan) throw new Error('legacy unresolved workflow needs explicit migration; refusing to replace its obligations');
     // Steering/status prompts cannot drop an unresolved execution contract.
@@ -92,17 +106,30 @@ function run(raw) {
     try { payload = JSON.parse(raw); } catch (_) { console.error('[Workflow Router] Invalid hook payload; lifecycle persistence unavailable.'); }
   }
   const prompt = promptArg || (typeof payload?.prompt === 'string' ? payload.prompt : '');
-  const result = core.route(promptArg, raw || null);
-  let plan = result.contract.workflowPlan;
+  const hostNotification = isHostNotificationPrompt(prompt);
+  // Host-generated notifications are lifecycle events, not user-authored task
+  // input. Never feed their text into the router: when there is an active
+  // contract we retain it below; when there is none, the event is a no-op.
+  const result = hostNotification ? null : core.route(promptArg, raw || null);
+  let plan = result?.contract?.workflowPlan || null;
   let persisted = null;
   let failure = null;
   try {
     persisted = persistWorkflow(plan, payload, prompt);
-    if (persisted?.retained) plan = persisted.workflow.workflowPlan;
+    if (persisted?.retained && persisted.workflow) plan = persisted.workflow.workflowPlan;
   } catch (error) { failure = error; }
-  if (result.sanitized) console.log(result.sanitized);
-  if (result.stderr) process.stderr.write(result.stderr);
-  if (persisted?.retained) console.log('\n=> Retaining unresolved workflow from earlier prompts; the checkpoint below is the active execution contract.');
+  if (hostNotification && !persisted?.workflow) {
+    console.log('\n=> Host notification — no active execution contract; ignored for routing.');
+    if (failure) {
+      console.error('[Workflow Router] ' + failure.message);
+      process.exitCode = 2;
+    }
+    return;
+  }
+  if (result?.sanitized) console.log(result.sanitized);
+  if (result?.stderr) process.stderr.write(result.stderr);
+  if (persisted?.hostNotification) console.log('\n=> Host notification — routing unchanged; keeping the active execution contract.');
+  else if (persisted?.retained) console.log('\n=> Retaining unresolved workflow from earlier prompts; the checkpoint below is the active execution contract.');
   core.printWorkflowPlan(plan);
   core.printRoutingCheckpoint(plan);
   core.printKernelContract(plan);
@@ -116,7 +143,7 @@ function run(raw) {
     console.log('   - Tier 3 / Fable source and artifact mutations require Git worktree isolation; unavailable isolation means BLOCKED.');
     console.log('   - Escape is limited to workflow-uncovered-scope or host-capability-unavailable, with stage, scope and evidence; other obligations remain mandatory.');
   }
-  if (persisted) {
+  if (persisted?.workflow) {
     const controller = path.join(persisted.hooksRoot, 'workflow-disposition.js');
     console.log('   - Workflow id: ' + persisted.workflow.workflowId);
     console.log('   - Memory write disposition: ' + (persisted.workflow.workflowPlan.memory?.write || 'none'));
@@ -130,12 +157,13 @@ function run(raw) {
   if (failure) {
     console.error('[Workflow Router] ' + failure.message);
     process.exitCode = 2;
-  } else if (result.status !== 0) process.exitCode = result.status || 1;
+  } else if (result && result.status !== 0) process.exitCode = result.status || 1;
 }
 
+if (typeof module !== 'undefined') module.exports = { isHostNotificationPrompt };
+
 if (process.argv.length > 2 || process.stdin.isTTY) run('');
-else {
-  let input = '';
+else {  let input = '';
   let finished = false;
   const finish = () => { if (finished) return; finished = true; clearTimeout(timeout); run(input); };
   const timeout = setTimeout(finish, 500);

package/docs/issue-20-rollup.md

@@ -1,47 +0,0 @@
-# Issue #20 umbrella rollup
-
-This rollup turns issue #20's historical checklist into bounded acceptance decisions. The review snapshot is `main` at `ba7853b`, checked on 2026-09-07. The umbrella owns coordination and release evidence; implementation details remain with the linked issue.
-
-## Closure status
-
-Issue #20 remains open after this PR. This branch adds deterministic parser,
-collision-gate, plugin-runner, and negative-control coverage, but it does not
-provide live opencode session evidence, a paid behavioral rerun, the proposed
-100-case study, or the three skill-specific improvements below. Those gaps are
-recorded explicitly rather than treated as closed by the deterministic gates.
-
-## Workstream decisions
-
-| Workstream | Evidence in the review snapshot | Acceptance state | Remaining claim boundary |
-| --- | --- | --- | --- |
-| #37 opencode enforcement | The real plugin API is implemented and mechanism coverage exists in `ci/mechanism-2n-opencode-plugin.test.js`; the integrated reflection lifecycle is `d790e7f` on the integration branch. | Integrated, pending final integration gates | No live opencode loading or session smoke evidence was available; do not claim live enforcement. |
-| #52 behavioral transcript parsing | Claude stream fixtures and parser coverage are integrated in `77efb06`; deterministic parser tests are available. | Integrated, pending final integration gates | No new paid behavioral rerun is part of this umbrella. Parse failures and missing tool visibility remain evidence states, not skill failures. |
-| Systematic gate hardening | The local gates now execute real negative controls; YAML frontmatter parsing fails closed in `ci/description-collision.js`, `ci/routing-check.js` skips clearly when waza is absent, and `ci/mechanism-2t-issue-20.test.js` covers CRLF behavioral parsing and plugin validation. | Deterministic hardening integrated | Live platform loading and model behavior remain unverified. |
-| #42 workspace identity and migration | Workspace-keyed state and migration coverage are integrated in `9dd2e3d`; the issue review identified session and migration acceptance as the relevant boundary. | Integrated, pending final integration gates | Do not claim every host/session migration path is live verified until the integration gate and targeted fixtures pass. |
-| #43 multi-agent workspace layout | The reviewed plan makes its root contract depend on #42. No implementation commit was present in the issue #20 review snapshot. | Deferred to its owner | Do not duplicate its layout or runtime work in this umbrella. |
-| #44 progressive disclosure | Documentation and reference checks are integrated in `b33f598`; `ci/disclosure-check.js` and its mechanism coverage are present. | Integrated, pending final integration gates | This records repository documentation evidence; it does not establish behavioral-model effectiveness. |
-| #56 behavioral rubric triage | The review found grader/source-boundary issues, including `command_exit_0` proving the grader command rather than the agent action. | Deferred to its owner | Do not reuse the historical pass-rate claims until the rubric and trace evidence are corrected. |
-| Extended 100-case study | The original issue proposed 100 cases, but the review did not establish a decision threshold or clean attribution between skill text, plugin enforcement, and grader behavior. | Explicitly deferred | No uncontrolled 100-case run is authorized by this rollup. Define paired design, failure taxonomy, and decision rule first. |
-| Five historical baseline failures | The committed 2026-08-27 records show one failed expectation in each of `baseline-debugging` (edge-case consideration), `baseline-performance` (binary-search suggestion), `baseline-security-review` (MD5 identification), `baseline-simple-bugfix` (function understanding), and `verify-before-done` (verification actually run). | Explicitly deferred | These are historical observations, not a new causal investigation or rerun; do not claim they were fixed by this PR. |
-| Skill-specific improvements | No targeted changes were made to `verification-loop`, `zoom-out`, or `security-review` in this branch. | Explicitly deferred | Strengthening verification enforcement, reflection-report detection, and vulnerability detection requires separate design and behavioral evidence. |
-| Release | The tag-triggered full gate and provenance publish workflow already exists. Historical `0.3.6` evidence is recorded in [docs/release-evidence.md](release-evidence.md). | Documentation complete; next release unproven | A prepared `0.3.7-beta` version is not evidence of a tag, npm publication, or GitHub release. |
-
-## Focused acceptance checks
-
-The integration owner should run these checks after incorporating the issue branches:
-
-```text
-npm test
-npm run test:mechanism
-npm run test:consistency
-npm run test:references
-npm run test:release
-npm run test:collision
-npm run test:routing:skills
-```
-
-The checks establish deterministic repository and routing health. They do not substitute for live opencode loading, a paid behavioral run, or npm/GitHub release evidence. Those claims require the artifacts named in [RELEASING.md](../RELEASING.md) and [docs/release-evidence.md](release-evidence.md).
-
-## Historical evidence boundary
-
-The local review artifact `.git/issue-review-20260907/release-evidence.md` records a successful `0.3.6` workflow (`33466676632`) and npm observation. It explicitly says that this is not proof of a `0.3.7-beta` release. This rollup preserves that distinction so an old successful release cannot be mistaken for current publication evidence.

package/docs/reviews/pr-142-issue-131.md

@@ -1,89 +0,0 @@
-# PR #142 / issue #131 completion review
-
-This review covers the implementation in the commit containing this report,
-starting from PR head `8b99baec44745e171f078fe9eb3dac6fd812b5c8`. It evaluates
-Harness engineering and the latest #131 decision, including mandatory mutation
-isolation. It is not a measured agent-performance benchmark.
-
-## Findings resolved
-
-| Original gap | Delivered behavior | Regression evidence |
-| --- | --- | --- |
-| Escape changed the whole workflow state and skipped isolation | Stage-scoped escape; isolation survives legacy escape and blocked states | `mechanism-2af-worktree-isolation.test.js`, `mechanism-2ah-workflow-lifecycle.test.js` |
-| Only cwd was checked | Registered linked checkout of the bound repo; direct/patch targets, move destinations, traversal, and links checked | `mechanism-2af-worktree-isolation.test.js` |
-| Windows runner used 8.3 paths while Git reported long names | Native physical-path resolution equates both spellings without relaxing isolation | Windows path regression and worktree suites |
-| Read-only shell prefixes accepted writes | Reject redirects, substitutions, chained commands and dangerous options; require isolated cwd for mutation/unknown commands | `mechanism-2af-worktree-isolation.test.js` |
-| Next prompt erased unresolved obligations | Stable workflow identity across steering prompts; stronger route requires replan | `mechanism-2ah-workflow-lifecycle.test.js` |
-| Same strategy/timestamp loosely matched any Fable run | Exact workflow, session and run correlation | `mechanism-2ah-workflow-lifecycle.test.js` |
-| Entry gate blocked its own bootstrap path | One bounded stage-specification file and trusted start controller; state/source writes remain gated | `mechanism-2ah-workflow-lifecycle.test.js` |
-| Stop trusted directory contents and pass labels | Expected manifest stages, correlated exit-zero evidence, worker attribution and fresh verifier required | `mechanism-2ah-workflow-lifecycle.test.js` |
-| Stop retry silently passed unresolved work | Retry records blocked; no satisfied state without required evidence | `mechanism-2ah-workflow-lifecycle.test.js` |
-| Failures could not recover cleanly | Observed fail-to-pass checks; explicit bounded replan; retained prior run evidence | `mechanism-2ah-workflow-lifecycle.test.js` |
-| Runtime policy scraped human-readable output | Kernel imports the structured core result; complete invariants persist with the plan | routing tests and lifecycle tests |
-| Current documents contradicted the PR | README, platform matrix, routing, architecture, Fable/worktree references and mirrors aligned | consistency/capability/reference gates |
-| Existing CI selected the first matching hook group | Action-gate regression finds its actual adapter among shared tool matchers | `ci/action-gate.test.js` |
-
-The first added isolation regression run failed 16 assertions against the PR
-baseline, then passed after repair. The baseline's four failing GitHub CI jobs
-also reported the action-gate matcher defect. The initial local checkout lacked
-dependencies, producing a separate CRLF-fixture setup failure; `npm ci` resolved
-that environment prerequisite.
-
-## Verification
-
-Local environment: Windows, PowerShell, Node.js 24.15.0, npm 11.12.1. Work was
-performed in an isolated linked worktree; the primary checkout remained clean.
-
-All 14 required gate categories passed: `npm test`, mutations, mechanism,
-consistency, repository contract, capability docs, references, release,
-collision, positive skill routing, routing invariants, OpenAI package/runtime,
-public submission, and platform compatibility. Failed checks were corrected and
-the affected gates rerun. The final `npm test` includes **44 mechanism suites**.
-
-The new lifecycle suite exercises **50 assertions against source and the same
-50 against the packaged OpenAI layout**, using actual child processes, Git
-repositories, worktrees, controller commands and hook payloads. Host payloads
-are fixtures: these are deterministic mechanism tests, not live agent sessions.
-
-Waza passed 30 canonical/nested skill readiness checks, 26 routing-spec checks,
-and token validation (57 successful commands). Positive routing covered 34
-cases across 26 direct skills and classified four nested skills.
-
-Build/types/lint have no separate project scripts; repository syntax and
-consistency gates apply. No coverage percentage is claimed. The security scanner
-reported 12 pre-existing documentation/test-pattern matches, including its own
-patterns and an explicitly fake token fixture; changed production code added no
-scanner findings. `npm ci` reported zero dependency vulnerabilities. Diff review
-and `git diff --check` passed. See the retained [gate summary](../../benchmarks/results/reviews/pr142-verification.json).
-
-Remote CI is a separate evidence layer. Its result must be read at the final PR
-head; this local record does not assert a future GitHub Actions outcome.
-
-## Reassessment
-
-Scores are review judgments about engineering readiness, each out of 100.
-Each row has four equally weighted criteria (25 points each), with the observed
-deductions shown. They are not success probabilities or benchmark results.
-
-| Dimension | Criteria scores | Total | Remaining deductions |
-| --- | --- | ---: | --- |
-| Contract coherence | entry 22, transitions 23, scoped exceptions 24, docs 23 | 92 | Skill applicability and iterative budgets still partly rely on executor compliance |
-| Mutation safety | worktree identity 23, targets 23, shell handling 17, state trust 12 | 75 | Arbitrary script effects need a host sandbox; runtime state is agent-writable |
-| Deterministic verification | gate breadth 25, negative cases 24, package parity 24, evidence checks 18 | 91 | Host-shaped fixtures cannot establish real host behavior or semantic check quality |
-| Operation and maintenance | entry/recovery 22, modularity 21, distribution 23, diagnostics/migration 18 | 84 | Manual stage setup, missing-metadata blocks and legacy-state repair add operator work |
-
-Equal-weight engineering score: **85.5/100** (approximately **86/100**).
-The system now has substantially stronger tested lifecycle and isolation
-contracts. It is suitable for further host validation with explicit boundaries.
-
-**Live-host reliability of these new gates remains unverified. Behavioral gain
-from this PR remains unmeasured.** Neither receives an invented effectiveness
-score. Older retained OpenCode evidence and older behavioral cases cannot prove
-this workflow change. This review does not claim superiority over other skill
-collections, reduced token cost, or improved task success rates.
-
-The next evidence needed is a retained Claude/Codex session showing routing,
-entry, mutation denial/allow, numeric stage results, worker correlation and Stop
-resolution; then paired same-model/same-task behavioral runs. OpenCode needs its
-own adapter before parity can be claimed. See [runtime limits](../workflow-runtime.md)
-and [platform capabilities](../platform-capabilities.md).