harness-everything 0.11.6 → 0.11.7

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "harness-everything",
       "source": "./",
       "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-      "version": "0.11.6",
+      "version": "0.11.7",
       "author": {
         "name": "Miya Daniel"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-everything",
   "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-  "version": "0.11.6",
+  "version": "0.11.7",
   "author": {
     "name": "Miya Daniel"
   },

package/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 All notable changes to this project are documented in this file.
 
+## [0.11.7](https://github.com/dyphn1/Harness-everything/compare/v0.11.6...v0.11.7) (2026-09-18)
+
+### Bug Fixes
+
+* Claude success path, rule-of-3 category, worktree scan ([fd8c9e7](https://github.com/dyphn1/Harness-everything/commit/fd8c9e79261a18a79883029f7179d94c18ec302e)), closes [#153](https://github.com/dyphn1/Harness-everything/issues/153) [#166](https://github.com/dyphn1/Harness-everything/issues/166) [#167](https://github.com/dyphn1/Harness-everything/issues/167) [#170](https://github.com/dyphn1/Harness-everything/issues/170)
+* fail closed on unbound host notifications ([48faf8c](https://github.com/dyphn1/Harness-everything/commit/48faf8caff38e2cc77d2eae0169d6ba62767d7de))
+* fail closed on unbound host notifications ([fea7201](https://github.com/dyphn1/Harness-everything/commit/fea72018ba74b6dc2cf6d273b4116a3503fdcda2))
+* Host notification routing and out-of-workspace edit accounting ([508a321](https://github.com/dyphn1/Harness-everything/commit/508a32141389612f8fc1c92f89ebe4fde88cee1e)), closes [#172](https://github.com/dyphn1/Harness-everything/issues/172) [#165](https://github.com/dyphn1/Harness-everything/issues/165) [#168](https://github.com/dyphn1/Harness-everything/issues/168)
+* ignore host notifications before routing ([ad355fd](https://github.com/dyphn1/Harness-everything/commit/ad355fdd98f45747b467d034adc4bf6fbcf1404b))
+* ignore host notifications before routing ([ea96577](https://github.com/dyphn1/Harness-everything/commit/ea96577d6f2916261a3a4484bfdb5358c828d475))
+* integrate Claude PostToolUse semantics ([6c3b447](https://github.com/dyphn1/Harness-everything/commit/6c3b447e7112c8a8984ad304de37c8819f17be27))
+* integrate Claude PostToolUse semantics ([a7077e9](https://github.com/dyphn1/Harness-everything/commit/a7077e9240b76a53367198c32a9d0c2645fbbc32))
+
 ## [0.11.6](https://github.com/dyphn1/Harness-everything/compare/v0.11.5...v0.11.6) (2026-09-18)
 
 ### Bug Fixes

package/README.md

@@ -82,6 +82,7 @@ The general installer only writes to your workspace (or, with `--global`, your h
 | `AGENTS.md` + `.agents/skills/` | Codex advisory instructions plus repo-scoped Agent Skills; Hermes can also consume trusted project skills from `.agents/skills/` |
 | `.continue/rules/harness.md` + `.continue/skills/` | Continue.dev advisory rule and installer candidate skill path; standalone skill discovery is `Unknown` |
 | `.hermes.md` | Hermes Agent project advisory context |
+| `.opencode/plugins/harness-enforcement.js` (manual copy, not installer-owned) | OpenCode enforcement plugin — the general installer has no `--opencode` path; copy `opencode-plugin/index.mjs` under a `.js` name per [opencode-plugin/README.md](opencode-plugin/README.md) |
 | `.claude/harness-everything/` (or the per-platform equivalent) | Harness installer/runtime bookkeeping owned by that integration |
 
 For `--global`, the installer uses each host's supported user-level skill location rather than assuming one shared directory works everywhere: shared Agent Skills remain under `~/.agents/skills/` where natively consumed, Continue uses `~/.continue/skills/`, Hermes uses `~/.hermes/skills/`, and Claude uses `~/.claude/skills/`.
@@ -212,11 +213,14 @@ This repo uses a flat layout (waza/agentskills.io convention). The table below m
 | `plugins/harness-everything` | **Distribution** | Local OpenAI/Codex plugin package plus canonical skill copies |
 | `submission/openai` | **Distribution / Review** | Public OpenAI Skills-only listing/test inputs |
 | `evals` | **Routing Evals** | 26 trigger/routing eval suites (waza format) |
+| `eval-framework` | **Quality Gates** | Negative-control fixtures for consistency/collision gates (not a skill) |
+| `contract-integrity` | **Quality Gates** | ADR→spec→ticket→test→implementation trace audit (Phase 1; not a directly routed skill) |
+| `telemetry` | **Quality Gates** | Local JSONL operational evidence layer with report/benchmark scripts (not a skill) |
 | `behavioral-evals` | **Behavioral Evals** | LLM-level discipline cases plus weekly structural validation workflow |
 | `benchmarks` | **Benchmarks** | BENCHMARK_SOP fixtures and recorded A/B results |
 | `docs` | **Documentation** | Philosophy, architecture, routing, reflection, platform capabilities, generated repository contract, audit |
 | `references` | **Documentation** | Shared checklists (security, performance, definition-of-done) |
-| `multi-agent-workspace` | **Skill (Tier 3)** | Scaffold six zones, select agency specialists, and generate bounded launchers |
+| `multi-agent-workspace` | **Skill (Tier 3)** | Scaffold a verified multi-agent workspace and select bounded specialists from an external catalog without vendoring the full roster |
 | `environment-detection` | **Foundation** | Preflight: detect OS, shell, package manager |
 | `eval-harness` | **Skill (Tier 2)** | Evaluate agent outputs against rubrics |
 | `fable-discipline` | **Skill (Tier 3)** | Fable execution guardrails when Fable is selected |
@@ -260,7 +264,7 @@ For a deep dive into individual modules and the underlying philosophy, explore o
 
 Fable model selection is documented in [fable-mode/references/model-matrix.md](fable-mode/references/model-matrix.md); the explicit entrypoints are `fable-haiku`, `fable-sonnet`, and `fable-opus`.
 
-Maintainers should follow [RELEASING.md](RELEASING.md) for tag-driven npm releases and record observations in [docs/release-evidence.md](docs/release-evidence.md). The issue #20 coordination decisions and evidence boundaries are captured in [docs/issue-20-rollup.md](docs/issue-20-rollup.md).
+Maintainers should follow [RELEASING.md](RELEASING.md) for tag-driven npm releases and record observations in [docs/release-evidence.md](docs/release-evidence.md). Issue #20 is closed (2026-09-10); its coordination history lives in git.
 
 ---
 
@@ -294,7 +298,7 @@ Mechanism tests prove individual packaged mechanisms; only real host/session evi
 
 Harness audits itself on a dated cycle by running its own test suite and VERIFICATION.md recipes — never by reading the code and assuming it works. The full scorecards, methodology, and per-cycle change log live in [docs/audit.md](docs/audit.md). Audit scorecards are historical snapshots; current platform capability claims live in [docs/platform-capabilities.md](docs/platform-capabilities.md).
 
-**Latest local audit baseline — 2026-09-01**: 26/26 on-disk skills, 26/26 routing-eval directories, and the local npm gates were green for that audit snapshot. Waza remained a CI-only gate in that checkout because its installer was not available as an npm package; run it on an LF-normalized export as documented by CI.
+**Latest local audit baseline — 2026-09-18** (macOS, Node.js 24; see [docs/audit.md](docs/audit.md)): 26/26 on-disk skills, 26/26 routing-eval directories, 34/34 positive routes, 275/275 invariant checks, and all 26 canonical skills within the 500-token limit. Deterministic gates were green except the pre-existing `mechanism-30` failure caused by leftover `.worktrees` fixtures (reproduced on the clean tree). Waza full-matrix spec verify and live model sessions remain on-demand evidence; run waza on an LF-normalized export as documented by CI.
 
 Measure on an LF export, not a Windows working tree — CRLF can inflate waza's token counts and trigger false budget failures.
 

package/ci/mechanism-2a-rule-of-3.test.js

@@ -68,6 +68,77 @@ helper.check(
   `Got exit=${successResult.code}, state=${JSON.stringify(resetState)}`
 );
 
+helper.runHook('rule-of-3-tracker.js', claudeFailurePayload);
+const claudeNoExitSuccess = helper.runHook('rule-of-3-tracker.js', {
+  hook_event_name: 'PostToolUse',
+  tool_name: 'Bash',
+  tool_input: { command: 'echo recovered' },
+  tool_response: {
+    stdout: 'recovered',
+    stderr: 'warning: successful command emitted an error-like diagnostic',
+  },
+  session_id: helper.SESSION_ID,
+});
+const noExitResetState = helper.readState('rule-of-3-state.json');
+helper.check(
+  '2a-claude-success-no-exit. PostToolUse without exitCode resets even with stderr diagnostics',
+  claudeNoExitSuccess.code === 0 &&
+    noExitResetState.count === 0 &&
+    noExitResetState.zoomOutResolved === true,
+  `Got exit=${claudeNoExitSuccess.code}, state=${JSON.stringify(noExitResetState)}`
+);
+
+helper.writeState('rule-of-3-state.json', {
+  count: 0, lastHash: null, zoomOutResolved: false, zoomOutCycles: 0, lastFailureAt: 0,
+});
+helper.runHook('rule-of-3-tracker.js', {
+  hook_event_name: 'PostToolUseFailure',
+  tool_name: 'Bash',
+  tool_input: { command: 'diff -rq hooks cache-hooks' },
+  error: 'Exit code 1\nworkflow-mutation-denied.js\nFiles hooks/a.js and cache-hooks/a.js differ',
+  session_id: helper.SESSION_ID,
+});
+const deniedFilenameState = helper.readState('rule-of-3-state.json');
+helper.check(
+  '2a-category-negative. File name containing denied stays unknown/threshold 3',
+  deniedFilenameState.category === 'unknown' && deniedFilenameState.threshold === 3,
+  `State=${JSON.stringify(deniedFilenameState)}`
+);
+
+helper.writeState('rule-of-3-state.json', {
+  count: 0, lastHash: null, zoomOutResolved: false, zoomOutCycles: 0, lastFailureAt: 0,
+});
+helper.runHook('rule-of-3-tracker.js', {
+  hook_event_name: 'PostToolUseFailure',
+  tool_name: 'Bash',
+  tool_input: { command: 'cat protected.txt' },
+  error: 'EACCES: permission denied, open protected.txt',
+  session_id: helper.SESSION_ID,
+});
+const permissionState = helper.readState('rule-of-3-state.json');
+helper.check(
+  '2a-category-permission. Real EACCES is permission/threshold 2',
+  permissionState.category === 'permission' && permissionState.threshold === 2,
+  `State=${JSON.stringify(permissionState)}`
+);
+
+helper.writeState('rule-of-3-state.json', {
+  count: 0, lastHash: null, zoomOutResolved: false, zoomOutCycles: 0, lastFailureAt: 0,
+});
+helper.runHook('rule-of-3-tracker.js', {
+  hook_event_name: 'PostToolUseFailure',
+  tool_name: 'Bash',
+  tool_input: { command: 'node slow.js' },
+  error: 'TimeoutError: operation timed out',
+  session_id: helper.SESSION_ID,
+});
+const timeoutState = helper.readState('rule-of-3-state.json');
+helper.check(
+  '2a-category-timeout. Real timeout is timeout/threshold 2',
+  timeoutState.category === 'timeout' && timeoutState.threshold === 2,
+  `State=${JSON.stringify(timeoutState)}`
+);
+
 helper.writeState('rule-of-3-state.json', { count: 3, lastHash: 'mech-test', zoomOutResolved: false });
 const tripResult = helper.runHook('rule-of-3.js', { session_id: helper.SESSION_ID });
 helper.check(

package/ci/mechanism-2ah-workflow-lifecycle.test.js

@@ -35,6 +35,14 @@ function git(args) {
 }
 const route = prompt => node('harness-everything/scripts/kernel-router.js', { ...payload, prompt });
 const gate = (tool, input, cwd = linked) => node('hooks/scripts/workflow-gate.js', { ...payload, cwd, tool_name: tool, tool_input: input });
+const persistDirect = (tool, input, cwd = repo, response = {}) => node('hooks/scripts/state-persist.js', {
+  ...payload,
+  cwd,
+  hook_event_name: 'PostToolUse',
+  tool_name: tool,
+  tool_input: input,
+  tool_response: response,
+});
 let toolUseSeq = 0;
 function beginShell(command, cwd = repo) {
   const toolUseId = 'toolu_fixture_' + (++toolUseSeq);
@@ -87,6 +95,20 @@ try {
   git(['init']); fs.writeFileSync(path.join(repo, 'README.md'), 'fixture\n'); git(['add', '.']);
   git(['-c', 'user.name=Harness Test', '-c', 'user.email=harness@example.invalid', 'commit', '-m', 'fixture']);
   git(['worktree', 'add', linked, '-b', 'isolated']);
+  const taskNotification = '<task-notification><summary>Background command "Run full test suite" failed with exit code 1</summary></task-notification>';
+  const unboundNotification = node('harness-everything/scripts/kernel-router.js', { cwd: repo, prompt: taskNotification });
+  check(unboundNotification.status === 0 &&
+    unboundNotification.stdout.includes('ignored for routing') &&
+    !unboundNotification.stdout.includes('WORKFLOW EXECUTION CONTRACT'),
+    'host notification without session binding is a routing no-op');
+  const noWorkflowNotification = route(taskNotification);
+  check(noWorkflowNotification.status === 0 && !fs.existsSync(file),
+    'host notification with no active workflow creates no contract');
+  check(noWorkflowNotification.stdout.includes('ignored for routing') &&
+    !noWorkflowNotification.stdout.includes('iterative-single') &&
+    !noWorkflowNotification.stdout.includes('WORKFLOW EXECUTION CONTRACT'),
+    'host notification with no active workflow emits no notification-derived routing contract');
+
   const routed = route('Refactor the entire repository architecture in dependent stages.');
   check(routed.status === 0, 'prompt hook creates workflow');
   const initial = read(file);
@@ -149,6 +171,15 @@ try {
   check(stop().status === 2, 'verification predating a new mutation is stale');
   write(file, mutationState);
   check(stop().status === 0 && read(file).state === 'satisfied', 'all covered stages and verifier resolve workflow to satisfied');
+  const satisfiedWorkflow = read(file);
+  const satisfiedNotification = route(taskNotification);
+  check(satisfiedNotification.status === 0 &&
+    read(file).workflowId === satisfiedWorkflow.workflowId &&
+    read(file).state === 'satisfied',
+    'satisfied workflow followed by host notification keeps the same satisfied contract');
+  check(!satisfiedNotification.stdout.includes('Run full test suite') &&
+    satisfiedNotification.stdout.includes('routing unchanged'),
+    'satisfied host notification text is not routed as new work');
   check(route('Refactor the entire repository architecture in dependent stages.').status === 0 && read(file).workflowId !== initial.workflowId, 'next completed-task boundary creates a fresh workflow');
   check(stop({ stop_hook_active: true }).status === 0 && read(file).state === 'blocked', 'Stop retry reports blocked instead of faking completion');
   check(gate('Write', { file_path: path.join(linked, 'src.js') }).status === 2, 'blocked state still prohibits mutation');
@@ -196,9 +227,117 @@ try {
   check(gate('Write', { file_path: path.join(repo, 'premature-primary.js') }, repo).status === 2, 'activated Tier 3 plan still blocks primary-tree mutation');
   fs.unlinkSync(file);
   check(route('Fix this checkout bug with a regression test').status === 0 && read(file).strategy === 'iterative-single', 'fresh bounded fix returns to Tier 2 iterative lifecycle');
+  let tier2 = read(file);
+  const tier2WorkflowId = tier2.workflowId;
+  write(file, { ...tier2, state: 'deferred' });
+  const deferredNotification = route(taskNotification);
+  check(deferredNotification.status === 0 &&
+    read(file).workflowId === tier2WorkflowId &&
+    read(file).state === 'deferred',
+    'deferred workflow followed by host notification keeps the same deferred contract');
+  check(!deferredNotification.stdout.includes('Run full test suite') &&
+    deferredNotification.stdout.includes('routing unchanged'),
+    'deferred host notification text is not routed as new work');
+  write(file, tier2);
+
   const iterationLimit = read(file).workflowPlan.limits.maxIterations;
   check(Number.isInteger(iterationLimit) && iterationLimit > 0, 'iterative route exposes a numeric iteration budget');
 
+  // #165: direct Edit/Write/apply_patch accounting follows workspace effects.
+  // Bookkeeping outside the repository must not consume Tier-2 iterations or
+  // advance workflow/Stop-gate mutation milestones.
+  const handoffFile = path.join(sessionDir, 'handoff-state.json');
+  const outsideTarget = path.join(temp, 'scratch-note.txt');
+  const beforeOutside = read(file);
+  const beforeOutsideIterations = beforeOutside.budget?.counters?.iterations || 0;
+  const beforeOutsideMutationAt = beforeOutside.lastMutationAt || 0;
+  const beforeOutsideEditAt = fs.existsSync(handoffFile) ? (read(handoffFile).lastEditAt || 0) : 0;
+  for (let i = 0; i < 3; i++) {
+    check(gate('Write', { file_path: outsideTarget }, repo).status === 0,
+      'out-of-workspace Write is admitted without Tier-2 mutation accounting');
+    fs.writeFileSync(outsideTarget, 'scratch ' + i + '\n');
+    const outsideResponse = i === 0
+      ? { stderr: 'warning: successful bookkeeping write emitted diagnostic text' }
+      : {};
+    check(persistDirect('Write', { file_path: outsideTarget }, repo, outsideResponse).status === 0,
+      'out-of-workspace Write post-tool state persists without mutation milestone');
+  }
+  const afterOutside = read(file);
+  const afterOutsideHandoff = read(handoffFile);
+  check((afterOutside.budget?.counters?.iterations || 0) === beforeOutsideIterations &&
+    (afterOutside.lastMutationAt || 0) === beforeOutsideMutationAt &&
+    (afterOutsideHandoff.lastEditAt || 0) === beforeOutsideEditAt &&
+    afterOutsideHandoff.status !== 'failed',
+    'out-of-workspace Writes leave iterations/milestones unchanged and PostToolUse stderr is not a failure');
+  check(stop().status === 0, 'out-of-workspace-only bookkeeping does not force verification before Stop');
+
+  check(route('Fix this checkout bug with a regression test').status === 0 && read(file).strategy === 'iterative-single',
+    'real follow-up user prompt after notification/accounting checks routes normally');
+  let observedDirectIterations = read(file).budget?.counters?.iterations || 0;
+  const internalTarget = path.join(repo, 'direct-inside.txt');
+  const beforeInternalMutationAt = read(file).lastMutationAt || 0;
+  check(gate('Write', { file_path: internalTarget }, repo).status === 0, 'in-workspace Write is admitted');
+  fs.writeFileSync(internalTarget, 'inside\n');
+  check(persistDirect('Write', { file_path: internalTarget }, repo).status === 0, 'in-workspace Write post-tool state persists');
+  check(read(file).budget.counters.iterations === ++observedDirectIterations &&
+    read(file).lastMutationAt >= beforeInternalMutationAt &&
+    read(handoffFile).lastEditAt > beforeOutsideEditAt,
+    'in-workspace Write consumes exactly one iteration and advances mutation milestones');
+
+  const mixedPatch = [
+    '*** Begin Patch',
+    `*** Update File: ${outsideTarget}`,
+    '@@',
+    '-scratch',
+    '+scratch updated',
+    `*** Update File: ${path.join(repo, 'README.md')}`,
+    '@@',
+    '-fixture',
+    '+fixture updated',
+    '*** End Patch',
+  ].join('\n');
+  check(gate('apply_patch', { patch: mixedPatch }, repo).status === 0, 'mixed apply_patch is admitted');
+  check(persistDirect('apply_patch', { patch: mixedPatch }, repo).status === 0, 'mixed apply_patch post-tool state persists');
+  check(read(file).budget.counters.iterations === ++observedDirectIterations,
+    'mixed apply_patch counts exactly once when any target is inside the workspace');
+
+  const pureOutsidePatch = [
+    '*** Begin Patch',
+    `*** Update File: ${outsideTarget}`,
+    '@@',
+    '-scratch updated',
+    '+scratch external only',
+    '*** End Patch',
+  ].join('\n');
+  const beforePureOutside = read(file);
+  const beforePureOutsideEditAt = read(handoffFile).lastEditAt || 0;
+  check(gate('apply_patch', { patch: pureOutsidePatch }, repo).status === 0, 'pure external apply_patch is admitted');
+  check(persistDirect('apply_patch', { patch: pureOutsidePatch }, repo).status === 0, 'pure external apply_patch post-tool state persists');
+  check(read(file).budget.counters.iterations === observedDirectIterations &&
+    read(file).lastMutationAt === beforePureOutside.lastMutationAt &&
+    (read(handoffFile).lastEditAt || 0) === beforePureOutsideEditAt,
+    'pure external apply_patch consumes no iteration and advances no mutation milestone');
+
+  const linkedTarget = path.join(linked, 'direct-linked.txt');
+  check(gate('Write', { file_path: linkedTarget }, linked).status === 0,
+    'Write inside a linked worktree is treated as workspace mutation');
+  fs.writeFileSync(linkedTarget, 'linked\n');
+  check(persistDirect('Write', { file_path: linkedTarget }, linked).status === 0,
+    'linked-worktree Write post-tool state persists');
+  check(read(file).budget.counters.iterations === ++observedDirectIterations,
+    'linked-worktree Write consumes exactly one iteration');
+
+  // Keep the #165 regression fixture from consuming the budget used by the
+  // pre-existing lifecycle/exhaustion assertions below.
+  fs.unlinkSync(internalTarget);
+  fs.unlinkSync(linkedTarget);
+  fs.unlinkSync(file);
+  if (fs.existsSync(handoffFile)) fs.unlinkSync(handoffFile);
+  check(route('Fix this checkout bug with a regression test').status === 0 &&
+    read(file).strategy === 'iterative-single' &&
+    (read(file).budget?.counters?.iterations || 0) === 0,
+    '#165 regression fixture resets into a fresh Tier-2 lifecycle baseline');
+
   // #155/#157 regression lock: read-only shell composition, including quoted
   // and escaped separator characters inside arguments, must never look like an
   // iterative mutation or advance the mutation clock.

package/ci/mechanism-2c-state-persist.test.js

@@ -16,14 +16,57 @@ helper.check(
 
 helper.runHook('state-persist.js', {
   session_id: helper.SESSION_ID,
+  hook_event_name: 'PostToolUse',
   tool_name: 'Bash',
-  tool_response: { stdout: 'ok', exitCode: 0 },
+  tool_response: {
+    stdout: 'ok',
+    stderr: 'warning: successful command emitted diagnostic text',
+  },
 });
 const resolvedHandoff = helper.readState('handoff-state.json');
 helper.check(
-  '2c. A subsequent successful command clears status back to idle',
+  '2c. Claude-shaped PostToolUse without exitCode clears failed state even with stderr diagnostics',
   resolvedHandoff.status === 'idle' && !!resolvedHandoff.lastResolved,
   `Got ${JSON.stringify(resolvedHandoff)}`
 );
 
+helper.runHook('state-persist.js', {
+  session_id: helper.SESSION_ID,
+  hook_event_name: 'PostToolUse',
+  tool_name: 'Bash',
+  tool_response: { stdout: '', stderr: 'numeric failure', exitCode: 2 },
+});
+const numericFailure = helper.readState('handoff-state.json');
+helper.check(
+  '2c. Numeric non-zero exit still records failure on hosts that report exit codes',
+  numericFailure.status === 'failed' && numericFailure.exitCode === 2,
+  `Got ${JSON.stringify(numericFailure)}`
+);
+
+helper.runHook('state-persist.js', {
+  session_id: helper.SESSION_ID,
+  hook_event_name: 'PostToolUse',
+  tool_name: 'Bash',
+  tool_response: { stdout: 'ok', exitCode: 0 },
+});
+const numericResolved = helper.readState('handoff-state.json');
+helper.check(
+  '2c. Numeric zero exit still clears failure state',
+  numericResolved.status === 'idle' && !!numericResolved.lastResolved,
+  `Got ${JSON.stringify(numericResolved)}`
+);
+
+helper.runHook('state-persist.js', {
+  session_id: helper.SESSION_ID,
+  hook_event_name: 'PostToolUseFailure',
+  tool_name: 'Bash',
+  error: 'host-declared failure without numeric exit code',
+});
+const eventFailure = helper.readState('handoff-state.json');
+helper.check(
+  '2c. PostToolUseFailure remains authoritative without numeric exitCode',
+  eventFailure.status === 'failed',
+  `Got ${JSON.stringify(eventFailure)}`
+);
+
 helper.finish();

package/ci/mechanism-2t-issue-20.test.js

@@ -64,12 +64,4 @@ helper.check(
   `exit ${negativeControls.status}\n${negativeControls.stdout}\n${negativeControls.stderr}`
 );
 
-const rollup = fs.readFileSync(path.join(helper.root, 'docs', 'issue-20-rollup.md'), 'utf8');
-const deferredWork = ['baseline-debugging', 'baseline-performance', 'baseline-security-review', 'baseline-simple-bugfix', 'verify-before-done', 'verification-loop', 'zoom-out', 'security-review'];
-helper.check(
-  '2t. issue rollup records unresolved acceptance work accurately',
-  /Issue #20 remains open/.test(rollup) && deferredWork.every(term => rollup.includes(term)),
-  'rollup must name the open issue and each deferred baseline/skill item'
-);
-
 helper.finish();

package/ci/mechanism-30-opencode-plugin-loadability.test.js

@@ -40,13 +40,29 @@ function verifyInstall(text) {
   }
 }
 
+function isWorktreeRoot(dir) {
+  try {
+    return fs.existsSync(path.join(dir, '.git'));
+  } catch (_) {
+    return false;
+  }
+}
+
 function walk(directory) {
   return fs.readdirSync(directory, { withFileTypes: true }).flatMap(entry => {
-    if (['node_modules', '.git'].includes(entry.name) || entry.isSymbolicLink()) return [];
+    if (['node_modules', '.git', '.worktrees'].includes(entry.name) || entry.isSymbolicLink()) return [];
     const file = path.join(directory, entry.name);
     const relative = path.relative(root, file).split(path.sep).join('/');
     if (relative === 'benchmarks/results' || relative === 'CHANGELOG.md') return [];
-    return entry.isDirectory() ? walk(file) : [file];
+    if (relative === '.worktrees' || relative.startsWith('.worktrees/')) return [];
+    if (entry.isDirectory()) {
+      // Skip linked worktrees / nested checkouts: a `.git` file marks a
+      // linked worktree root, a `.git` dir marks a nested repo. Either way
+      // the content belongs to another checkout, not this one (#170).
+      if (isWorktreeRoot(file)) return [];
+      return walk(file);
+    }
+    return [file];
   });
 }
 
@@ -68,12 +84,28 @@ try {
   }
   assert.deepStrictEqual(invalidTargets('opencode-plugin/index.mjs .opencode/plugins/example.js'), []);
 
-  const violations = [];
-  for (const file of walk(root).filter(file => /\.(?:md|js|mjs|json|jsonc|yml|yaml|txt)$/.test(file))) {
+  const scanViolations = (readText = file => fs.readFileSync(file, 'utf8')) => {
+    const violations = [];
+    for (const file of walk(root).filter(file => /\.(?:md|js|mjs|json|jsonc|yml|yaml|txt)$/.test(file))) {
+      const text = readText(file);
+      for (const target of invalidTargets(text)) violations.push(`${path.relative(root, file)}: ${target}`);
+    }
+    return violations;
+  };
+  assert.deepStrictEqual(scanViolations(), [], 'Unsupported OpenCode install destinations; only .js/.ts are auto-discovered');
+
+  const scannedFiles = walk(root);
+  assert.ok(scannedFiles.includes(readmeFile), 'Tracked OpenCode README must remain in the repository scan');
+  const plantedTarget = '.opencode/plugins/' + 'negative-control.mjs';
+  const planted = scanViolations(file => {
     const text = fs.readFileSync(file, 'utf8');
-    for (const target of invalidTargets(text)) violations.push(`${path.relative(root, file)}: ${target}`);
-  }
-  assert.deepStrictEqual(violations, [], 'Unsupported OpenCode install destinations; only .js/.ts are auto-discovered');
+    return file === readmeFile ? text + '\n' + plantedTarget + '\n' : text;
+  });
+  assert.ok(
+    planted.some(item => item === `${path.relative(root, readmeFile)}: ${plantedTarget}`),
+    'Scanner negative control must fail when a tracked file contains an unsupported .mjs install target'
+  );
+
   const readme = fs.readFileSync(readmeFile, 'utf8');
   for (const destination of ['.opencode/plugins/harness-enforcement.js', '~/.config/opencode/plugins/harness-enforcement.js']) {
     assert.ok(readme.includes(`cp opencode-plugin/index.mjs ${destination}`));

package/docs/architecture.md

@@ -73,6 +73,23 @@ For selected Fable topologies on Claude:
 
 Other topologies use their own applicable mechanisms: loop budgets, regular verification stop-gates, action gates, and task-specific skills. Mechanism coverage is not assumed identical across hosts.
 
+### Scoped runtime advisories and capabilities
+
+Two kernel mechanisms adjust plans without changing the mandatory-workflow contract:
+
+- **Ensemble policy (`harness-everything/scripts/ensemble-policy.js`):** an advisory plan annotation, not a separate topology. It is selected only when uncertainty is high (or stakes are high) **and** the task asks for comparable outputs or preserves explicit disagreement **and** the selected strategy is already `fable-*`. Creative generation, mechanical bulk work, an explicit user prohibition, unavailable subagents, or a blocked base plan force exclusion. When selected, the plan caps at 3 candidates with `preserve-disagreement` synthesis, an independent verifier, and `parallel-self-consistency` pattern invariants. Covered by deterministic mechanism tests; no live-host effectiveness claim follows from the annotation alone.
+- **Single-use memory capability (`kernel-router.js#issueMemoryCapability`):** when the selected plan permits memory writes, the router issues one capability token bound to `sessionId`/`workflowId` with a stored SHA-256 hash (`memoryAuthorization`, coordinator-only writer role, `usedAt` tracking). Plans with `memory.write === 'none'` receive no capability. This binds a memory write to the workflow that authorized it; it is not a general credential and proves nothing about a live host honoring the binding.
+
+### PreToolUse guard trio and denied-mutation probes
+
+On the Claude hook path, three narrowly scoped `PreToolUse` guards sit alongside the workflow/action gates:
+
+- `boundary-guard.js` (Grep/Glob/Read): hard-blocks whole-file reads over 512KB without `offset`/`limit` and searches inside known noise directories (`node_modules`, `.git`, build output, etc.). Fails open on parse/lookup errors.
+- `depth-guard.js` (Write): blocks overwriting an existing file that was never Read earlier in the session transcript. New files are unaffected. Fails open on parse/lookup errors.
+- `context-compact.js`: estimates working-tree context pressure from `git status`/`git diff --numstat` so later stages can compact or halt before lost-in-the-middle degradation.
+
+Shell mutation accounting is per-tool-call: `workflow-isolation.js` fingerprints observed effects per tool-use identity, `state-persist.js` settles probes in a single ordered handler, and `workflow-mutation-denied.js` discards probes for denied shell executions so a denial never counts as an observed mutation. See [runtime transitions and limitations](workflow-runtime.md). These are mechanism-tested behaviors on the packaged hook surface, not proof that a live session loaded or fired them.
+
 ## Integration Touchpoints
 
 Harness aligns to each host's actual lifecycle/tool APIs. Shared skill text defines a contract; only supported host mechanisms can mechanically block or observe particular transitions.

package/docs/audit.md

@@ -2,17 +2,58 @@
 
 Maintainer-facing audit record. If you just want to know whether Harness works and how to verify it yourself, start at [VERIFICATION.md](../VERIFICATION.md) instead — this file records *how the scores below were obtained* and what changed between audit cycles.
 
-> **Historical snapshot boundary:** the scorecard below is the 2026-09-01 audit and is intentionally preserved as evidence of what was measured on that date. Platform capabilities have changed since then (including the OpenAI/Codex local plugin work and the OpenCode plugin implementation). Do not treat the 2026-09-01 platform rows as current-state documentation; use [platform-capabilities.md](platform-capabilities.md) for the current matrix.
+> **Historical snapshot boundary:** the scorecards below are dated audits and are intentionally preserved as evidence of what was measured on each date. Platform capabilities have changed since the 2026-09-01 snapshot (including the OpenAI/Codex local plugin work and the OpenCode plugin implementation). Do not treat any dated platform row as current-state documentation; use [platform-capabilities.md](platform-capabilities.md) for the current matrix.
 
-**Last self-audited: 2026-09-01**, by running the actual test suite and the VERIFICATION.md recipes on Windows 11 — not by reading the code and assuming it works.
+**Last self-audited: 2026-09-18**, by running the deterministic test suite and gates on macOS (Node.js 24.14.1) — not by reading the code and assuming it works. The 2026-09-01 Windows 11 snapshot is preserved below. Live-host and behavioral evidence layers were not re-run in this cycle; retained artifacts are referenced, not re-measured.
 
-## The 2026-07-23 mis-measurement incident
+## The 2026-09-18 audit cycle
+
+Measured on `docs/sync-skills-and-mechanisms` at `45f2123` (docs-only delta over v0.11.6): 26/26 on-disk canonical skills, 26/26 routing-eval directories (`evals/` also holds `evaluation-reports.md`), and the following gate results:
+
+| Gate | Result on 2026-09-18 |
+|---|---|
+| `npm test` (self-regression, 43 passing checks) | Green except one pre-existing failure: `mechanism-30-opencode-plugin-loadability`, reproduced on the clean tree and caused by leftover `.worktrees/docs-skill-catalog` fixtures asserting `.mjs` destinations — not by product code |
+| `npm run test:mutations` | Passed: 8 production mutations rejected by focused tests |
+| `npm run test:consistency` (incl. doc-capability + repo-contract) | Passed |
+| `npm run test:references` | Passed: 66 skill path references resolve across 26 skills |
+| `npm run test:collision` | Passed: no description collisions at 0.75 threshold |
+| `npm run test:routing:skills` | Passed: 34 positive cases across 26 direct skills; 4 nested skills classified |
+| `npm run test:routing:invariants` | Passed: 275 checks, 0 failures (incl. workflow execution enforcement) |
+| `node ci/disclosure-check.js` | Passed: 26 skills, 26 workflow docs |
+| `npm run test:plugin:openai` / `test:plugin:submission` / `test:platform:compatibility` / `test:release` | All passed; release catalog green for v0.11.6 at 26/26 |
+| `waza tokens check` | All 26 canonical skills within the 500-token limit; the single exceedance is the intentional `eval-framework/fixtures/over-budget-skill` negative control (855 tokens, exists to exercise the failure path) |
+
+Since the 2026-09-01 snapshot, the product gained the mandatory-workflow contract (#142), runtime budget enforcement (#143), structured action gate (#144), memory governance (#145), self-evolve closed loop (#146), telemetry core (#147), contract-integrity phase 1 (#148), workflow controller recovery and isolation hardening (#150/#152/#154/#156/#158), observed-mutation accounting (#160), the Codex local plugin plus Claude certification boundary (#123), OpenCode `.js` loadability guard and partial live-host evidence (#128/#129), and the paired-benchmark contract (#130) — all covered by deterministic mechanism tests. The docs lag this cycle closed: stale `docs/workflows` rewrites, the README index gaps, and the previously undocumented ensemble/memory/guard/probe mechanisms are synced in the same change as this audit entry.
+
+## Five Core Verification Criteria — 2026-09-18 re-measurement
+
+| Criterion | Score | Verified basis |
+|---|---|---|
+| **Skill Description Completeness** | 10/10 | 26/26 skill directories carry complete frontmatter and the required trigger sections, verified by the consistency gate in this cycle. Internal hooks remain intentionally non-routable. |
+| **Routing Accuracy** | 9/10 | 34/34 positive prompts across all 26 skills plus 275/275 invariant-routing checks in this cycle. Waza generalization (ambiguous/metaphorical prompts) and live model sessions remain unmeasured. |
+| **Test Coverage of All Skills** | 9.5/10 | Self-regression now spans syntax, CLI, routing matrix, positive route coverage, invariant routing, references, behavioral-case structure, Fable contract, mutations, and 40+ mechanism suites. Waza full-matrix verify and live sessions remain separate on-demand evidence; `mechanism-30` is red only where the stale `.worktrees` leftover exists. |
+| **Configuration Balance** | 9/10 | Hard `exit(2)` blocking hooks on Claude Code, mechanism-tested local Codex plugin package, and partial OpenCode live-host evidence (project `.js` scope, 1.18.31 macOS) — all centralized in `docs/platform-capabilities.md`. Live parity beyond the retained artifacts is still unclaimed. |
+| **Workflow Conformance** | 9/10 | 26/26 skills have matching workflow documents (two stale ones rewritten in this cycle), the selected-workflow contract with escape/budget/stop-gate semantics is mechanism-tested, and disclosure passes. Runtime tool-call sequence conformance remains host-dependent and is not claimed. |
+
+## Overall Scorecard — 2026-09-18
+
+| Category | Score | Notes |
+|---|---|---|
+| **Architecture** | 9/10 | Per-session state isolation, worktree-gated Tier 3 mutation, per-tool mutation probes settled in one ordered handler, and single-use memory capabilities — all mechanism-tested in this cycle. |
+| **Test Coverage** | 9.5/10 | 43 passing self-regression checks, 8/8 mutations rejected, 66/66 references resolve. Live model evaluation remains on-demand and is not represented by a local simulation. |
+| **README Completeness** | 9.5/10 | Catalog counts, layer labels, route coverage, and the 26-skill tree match after this cycle's index fix (`contract-integrity`/`telemetry`/`eval-framework` rows added). |
+| **Maintainability** | 9/10 | ~600 commits across 20+ PRs since 09-01 landed without breaking the consistency/release/disclosure gates; new non-skill directories are documented as non-skills rather than left ambiguous. |
+| **Skills Design** | 9.5/10 | All 26 skills keep the Skill Contract format, `USE FOR`/`DO NOT USE FOR` sections, and the 500-token limit (verified by waza in this cycle); internal hooks remain intentionally non-routable. |
+| **Agent Compatibility** | 9/10 | Claude hard-mechanism support measured, Codex local plugin mechanism-tested, OpenCode partial live evidence retained — see the current platform matrix, not this row, for status. |
+| **Beginner Friendliness** | 7.5/10 | Unchanged since 09-01: Tier Routing / Rule of 3 / session-scoped state remain load-bearing concepts. The two rewritten workflow docs reduce stale-doc confusion but add no onboarding track. Not addressed in this audit round. |
+
+## The 2026-07-23 mis-measurement incident (preserved)
 
 Seven independent AI-model audits (Gemini 3.1 Pro, Gemini 3.5 Flash, GPT/Copilot on Mistral Medium/Small, and others) ran the same week and disagreed sharply on whether core hooks even functioned. Three of them tested `rule-of-3.js`, `boundary-guard.js`, and `state-persist.js` by piping JSON through `echo '...' | node script.js` in Windows Git Bash, which mangles stdin/TTY state and produced false "broken" verdicts. Re-running the identical payloads through Node's own `child_process` stdin API (the technique VERIFICATION.md's recipes now use) showed every one of those mechanisms working exactly as documented — the scores below reflect that corrected, verified state, not the average of the seven reports.
 
 This incident is why VERIFICATION.md's recipes were rewritten to be Windows-safe (`node -e` stdin instead of a shell `echo` pipe), and why the §2 mechanism checks were automated as `ci/mechanism-test.js` (`npm run test:mechanism`) — copy-paste recipes that can be mis-executed are not a reliable verification substrate.
 
-## Five Core Verification Criteria (per VERIFICATION.md §5a)
+## Five Core Verification Criteria — 2026-09-01 snapshot (per VERIFICATION.md §5a)
 
 | Criterion | Score | Verified basis |
 |---|---|---|
@@ -22,7 +63,7 @@ This incident is why VERIFICATION.md's recipes were rewritten to be Windows-safe
 | **Configuration Balance** | 8.5/10 | **Historical 2026-09-01 result:** hard `exit(2)` blocking hooks were measured on Claude Code and the other then-installed platform paths were evaluated as advisory. This row predates the later OpenAI/Codex local plugin and OpenCode plugin work; see `docs/platform-capabilities.md` for current status. |
 | **Workflow Conformance** | 8.5/10 | Every skill in the snapshot had a matching workflow document, and `ci/skill-routing-check.js` executed every positive route case against the real router. Runtime tool-call sequence conformance remained host-dependent and was not claimed. |
 
-## Overall Scorecard
+## Overall Scorecard — 2026-09-01 snapshot
 
 | Category | Score | Notes |
 |---|---|---|
@@ -36,6 +77,12 @@ This incident is why VERIFICATION.md's recipes were rewritten to be Windows-safe
 
 ## Change log by audit cycle
 
+### 2026-09-18
+- Re-measured the deterministic suite and gates on macOS (Node.js 24.14.1): 43 passing self-regression checks, 8/8 mutations rejected, 66/66 references resolve, 34/34 positive routes, 275/275 invariant checks, disclosure 26/26, release catalog green for v0.11.6. Sole red is the pre-existing `mechanism-30` failure from leftover `.worktrees/docs-skill-catalog` fixtures, reproduced on the clean tree.
+- Closed the docs lag accumulated since 09-01 in the same change: rewrote the stale `docs/workflows/harness-everything.md` and `install-cognitive-os.md`, added the missing README index rows (`contract-integrity`/`telemetry`/`eval-framework`), and documented the ensemble policy, single-use memory capability, guard trio, and mutation-probe lifecycle in `docs/architecture.md` / `docs/workflow-runtime.md`.
+- Product changes since 09-01 now covered by mechanism tests: mandatory-workflow contract, budget enforcement, structured action gate, memory governance, self-evolve closed loop, telemetry core, contract-integrity phase 1, controller recovery/isolation hardening, observed-mutation accounting, Codex local plugin, OpenCode partial live evidence, paired-benchmark contract. Live-host and behavioral layers were not re-run; retained artifacts stand.
+- Beginner Friendliness stays 7.5/10: still no onboarding track. Candidate for the next cycle.
+
 ### 2026-09-01
 - Fable v3 integration exposed explicit Haiku, Sonnet, and Opus entrypoints, with deterministic model selection and visible inline fallback or blocked escalation in `fable-mode/model-matrix.json` and `fable-mode/scripts/model-selector.js`.
 - The workflow used native host TODO tracking or Markdown checklists. The older shared TODO CLI/state-machine references below are retained only as historical audit evidence; no current runtime, test, or active workflow depends on them.

package/docs/release-evidence.md

@@ -9,6 +9,9 @@ The following evidence was collected on 2026-09-07 before the issue #20 integrat
 | Version | Registry observation | GitHub release | Workflow run | Gate and publish result |
 | --- | --- | --- | --- | --- |
 | 0.3.6 | `npm view harness-everything version dist-tags --json`: version and latest are `0.3.6` | `v0.3.6`, published 2026-09-01T03:50:44Z | [33466676632](https://github.com/dyphn1/Harness-everything/actions/runs/33466676632), commit `5aa74119d08ff241a7d6fe8f163a6a0d40c3c932` | `gate=success`, `publish=success` |
+| 0.11.6 | `npm view harness-everything version dist-tags --json` (collected 2026-09-18): version and latest are `0.11.6` | `v0.11.6`, published 2026-09-18T12:51:58Z | [35346673284](https://github.com/dyphn1/Harness-everything/actions/runs/35346673284), commit `23d87db8230dcb524651dc67e932f54aa6f5c737` | `gate=success` (12/12 jobs incl. skill-quality, runtime-floor, self-regression x3 OS, consistency x3 OS, installer-e2e x3 OS, release-semantics), `publish=success` (job `release`) |
+
+Intermediate versions between 0.3.6 and 0.11.6 were published via the same tag-driven workflow but were not individually ledgered here; the rows above are the two deliberately collected observations. A registry/GitHub listing alone is still not a completed row — each field must be a command output or inspectable URL.
 
 The source capture for this row is the local review artifact `.git/issue-review-20260907/release-evidence.md`. That review artifact is not expected to be present in every checkout; it is historical evidence, not a release artifact shipped in the npm package.
 

package/docs/workflow-runtime.md

@@ -63,6 +63,19 @@ have effects a hook cannot infer. OS/host sandboxing is needed to contain them.
 Agent-writable state is also not tamper-proof. These mechanisms prevent tested
 bypasses; they do not establish durable containment against a malicious agent.
 
+## Mutation probes
+
+Shell-effect accounting is keyed per tool call, not per command text. The gate
+registers a pending probe per shell tool-use identity (`workflow-isolation.js`),
+`state-persist.js` settles probes in a single ordered handler, and
+`workflow-mutation-denied.js` discards the probe when that shell execution is
+denied — a denial is never recorded as an observed mutation. Staging-insensitive
+fingerprinting keeps the comparison on visible content, so metadata-only Git
+operations do not register as workspace effects. These lifecycle semantics are
+covered by deterministic workflow mechanism tests (`ci/mechanism-2ah-*`); live
+host loading and behavioral improvement still require separately retained host
+traces and paired evaluations.
+
 ## Escape, replan, and completion
 
 Escape names one stage in the correlated run and records the uncovered scope,