harness-everything 0.11.6 → 0.11.7

package/hooks/scripts/workflow-gate.js

@@ -4,7 +4,7 @@
 const path = require('path');
 const fs = require('fs');
 const { loadWorkflow, saveWorkflow, isMajorWorkflow, matchingRun, registerMutationProbe, recordBudgetEvent, readHookInput, WORKFLOW_CONTROLLER_COMMANDS } = require('./lib/workflow-runtime');
-const { key, classifyShell, workspaceFingerprint, shellProbeKey, cwdOf, commandOf, mutationPaths, linkedWorktree, assertTargets, assertShellScope } = require('./lib/workflow-isolation');
+const { key, classifyShell, workspaceFingerprint, shellProbeKey, cwdOf, commandOf, mutationPaths, directMutationInWorkspace, linkedWorktree, assertTargets, assertShellScope } = require('./lib/workflow-isolation');
 
 const DIRECT = new Set(['Edit', 'Write', 'apply_patch']);
 const SHELL = new Set(['Bash', 'PowerShell', 'exec_command']);
@@ -48,6 +48,10 @@ function decide(payload) {
     throw new Error('selected Fable workflow has no correlated run. Write workflow-stages.json at the displayed session path, then use workflow-disposition.js start.');
   }
   if (DIRECT.has(tool)) {
+    // Bookkeeping outside the workspace (scratchpad, memory files, temp
+    // notes) is not a workspace mutation: it consumes no Tier-2 iteration
+    // and advances no mutation milestone (#165).
+    if (!directMutationInWorkspace(payload, cwd, root)) return;
     if (workflow.strategy === 'iterative-single') {
       recordBudgetEvent(context, 'iteration', { evidence: `${tool}:direct-mutation` });
     }

package/opencode-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-enforcement",
   "description": "Repository inventory for the opencode enforcement plugin and its standalone helper",
-  "version": "0.11.6",
+  "version": "0.11.7",
   "runtime": "index.mjs",
   "hooks": {
     "verify": "hooks/verify.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.11.6",
+  "version": "0.11.7",
   "description": "Harness OS: An Orchestrated Agent Operating System for AI-driven Development",
   "main": "harness-everything/scripts/bootstrap.js",
   "bin": {

package/plugins/harness-everything/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.11.6",
+  "version": "0.11.7",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/hooks/scripts/lib/workflow-isolation.js

@@ -248,6 +248,35 @@ function mutationPaths(payload) {
   }
   return [input.file_path || input.filePath || input.path].filter(value => typeof value === 'string' && value.trim());
 }
+
+// Bound workspace root plus its linked worktrees. Git failures (e.g. a
+// non-git workspace) degrade to the root alone instead of throwing, so
+// Tier-2 accounting never blocks on this enumeration (#165; cf. #162).
+function worktreeRoots(root) {
+  const roots = [root];
+  try {
+    for (const field of git(root, ['worktree', 'list', '--porcelain', '-z']).split('\0')) {
+      if (field.startsWith('worktree ')) {
+        const candidate = field.slice('worktree '.length).trim();
+        if (candidate) roots.push(candidate);
+      }
+    }
+  } catch (_) { /* root alone */ }
+  return roots;
+}
+
+// Direct-tool (Edit/Write/apply_patch) targets count against the Tier-2
+// budget only when at least one target lies inside the workspace (#165).
+// Unknown targets (no parseable path) stay conservative and count.
+function directMutationInWorkspace(payload, cwd, root) {
+  const targets = mutationPaths(payload);
+  if (!targets.length) return true;
+  const roots = worktreeRoots(root);
+  return targets.some(target => {
+    const resolved = path.resolve(cwd, target);
+    return roots.some(candidate => within(candidate, resolved));
+  });
+}
 function assertTargets(payload, cwd, isolatedRoot) {
   const targets = mutationPaths(payload);
   if (!targets.length) throw new Error('mutation target is unknown; cannot verify worktree isolation');
@@ -274,4 +303,4 @@ function assertShellScope(command, cwd, isolatedRoot) {
   }
 }
 
-module.exports = { canonical, key, within, linkedWorktree, classifyShell, workspaceFingerprint, shellProbeKey, inputOf, cwdOf, commandOf, mutationPaths, assertTargets, assertShellScope };
+module.exports = { canonical, key, within, linkedWorktree, classifyShell, workspaceFingerprint, shellProbeKey, inputOf, cwdOf, commandOf, mutationPaths, worktreeRoots, directMutationInWorkspace, assertTargets, assertShellScope };

package/plugins/harness-everything/hooks/scripts/rule-of-3-tracker.js

@@ -17,6 +17,7 @@ process.stdin.on('end', () => {
     const payload = JSON.parse(inputData);
     const hookEventName = payload.hook_event_name || payload.hookEventName || '';
     const isFailureEvent = hookEventName === 'PostToolUseFailure';
+    const isSuccessEvent = hookEventName === 'PostToolUse';
     const toolResponse = payload.tool_response || {};
     const stdout = toolResponse.stdout ?? payload.stdout ?? '';
     const stderr = toolResponse.stderr ?? payload.stderr ?? '';
@@ -25,10 +26,10 @@ process.stdin.on('end', () => {
     const exitCode = typeof rawExitCode === 'number' ? rawExitCode : undefined;
 
     const explicitFailure = exitCode !== undefined && exitCode !== 0;
-    const explicitSuccess = exitCode === 0;
     const stderrSignal = typeof stderr === 'string' && stderr.trim().length > 0;
     const looksLikeError = /\b(error|fail|failed|failure|exception|fatal|panic|traceback|denied|refused|cannot|unable)\b/i.test(stderr);
-    const isFailure = isFailureEvent || explicitFailure || (exitCode === undefined && stderrSignal && looksLikeError);
+    const isFailure = isFailureEvent || explicitFailure ||
+      (!isSuccessEvent && exitCode === undefined && stderrSignal && looksLikeError);
     const errorText = isFailureEvent
       ? (failureText || (stderrSignal ? stderr : stdout) || '')
       : ((stderrSignal ? stderr : stdout) || failureText || '');
@@ -47,19 +48,22 @@ process.stdin.on('end', () => {
       const filePath = payload.tool_input?.file_path || payload.tool_input?.filePath || '';
       const command = payload.tool_input?.command || '';
 
-      // Categorize failure type for context-aware thresholds
+      // Categorize failure type for context-aware thresholds.
+      // NOTE (#167): match anchored diagnostic phrases, not bare substrings.
+      // A bare `denied`/`timeout` substring matches file names such as
+      // `workflow-mutation-denied.js` and misclassifies the failure.
       let category = 'unknown';
-      if (/SyntaxError|Unexpected token|Syntax Error/i.test(errorText)) {
+      if (/\bSyntaxError\b|Unexpected token|Syntax Error/i.test(errorText)) {
         category = 'syntax';
-      } else if (/ENOENT|not found|No such file|找不到|不存在/i.test(errorText)) {
+      } else if (/\bENOENT\b|\bnot found\b|No such file|找不到|不存在/i.test(errorText)) {
         category = 'environment';
-      } else if (/timeout|timed out|超時|逾時/i.test(errorText)) {
+      } else if (/\bETIMEDOUT\b|TimeoutError|\btimeout\b|\btimed out\b|\btiming out\b|超時|逾時/i.test(errorText)) {
         category = 'timeout';
       } else if (/test.*fail|assertion|AssertionError|測試.*失敗|斷言.*錯誤/i.test(errorText)) {
         category = 'test';
-      } else if (/permission|denied|EACCES|權限/i.test(errorText)) {
+      } else if (/\bpermission denied\b|\bEACCES\b|\bEPERM\b|權限.*(拒絕|不足|被拒)|拒絕.*權限/i.test(errorText)) {
         category = 'permission';
-      } else if (/dependency|module not found|Cannot find module|模組.*找不到/i.test(errorText)) {
+      } else if (/\bdependency\b|\bmodule not found\b|Cannot find module|模組.*找不到/i.test(errorText)) {
         category = 'dependency';
       }
 
@@ -114,7 +118,11 @@ process.stdin.on('end', () => {
       state.lastFailureAt = Date.now();
 
       fs.writeFileSync(stateFile, JSON.stringify(state, null, 2), 'utf8');
-    } else if (!isFailureEvent && explicitSuccess) {
+    } else if (!isFailure) {
+      // NOTE (#166, follows #153): Claude Code PostToolUse success payloads
+      // carry no numeric exit code. The lifecycle event is authoritative:
+      // PostToolUse is success unless a numeric non-zero status contradicts it;
+      // hosts without lifecycle event names keep the conservative stderr fallback.
       // A successful action after an accepted zoom-out is an objective recovery
       // boundary. Emit only IDs/hashes/category; never copy command/output text.
       if ((state.zoomOutCycles || 0) > 0 && state.lastHash) {

package/plugins/harness-everything/hooks/scripts/state-persist.js

@@ -3,7 +3,7 @@ const fs = require('fs');
 const path = require('path');
 const { getWorkspaceRoot, getSessionDir } = require('./lib/harness-state');
 const { loadWorkflow, saveWorkflow, peekMutationProbe, settleMutationProbe } = require('./lib/workflow-runtime');
-const { cwdOf, shellProbeKey, workspaceFingerprint } = require('./lib/workflow-isolation');
+const { cwdOf, shellProbeKey, workspaceFingerprint, directMutationInWorkspace } = require('./lib/workflow-isolation');
 const { observeTool } = require('./lib/telemetry');
 
 // Commands that count as "verification ran" for the Stop gate
@@ -79,9 +79,10 @@ function processState(payload) {
       const exitCode = typeof rawExitCode === 'number' ? rawExitCode : undefined;
       const stderrSignal = typeof stderr === 'string' && stderr.trim().length > 0;
       const hookEvent = payload.hook_event_name || payload.hookEventName || '';
+      const isSuccessEvent = hookEvent === 'PostToolUse';
       const isFailed = hookEvent === 'PostToolUseFailure' ||
         (exitCode !== undefined && exitCode !== 0) ||
-        (exitCode === undefined && stderrSignal);
+        (!isSuccessEvent && exitCode === undefined && stderrSignal);
       const toolName = payload.tool_name || payload.tool || 'command';
       const observedMutation = observeWorkspaceMutation(payload, root);
 
@@ -97,8 +98,13 @@ function processState(payload) {
         state.tool = toolName;
         state.exitCode = exitCode;
         state.errorSummary = output.trim();
-      } else if (exitCode === 0 && state.status === 'failed') {
-        // Clear failed state or mark as idle/resolved
+      } else if (!isFailed && state.status === 'failed') {
+        // Clear failed state or mark as idle/resolved.
+        // NOTE (#166, follows #153): Claude Code Bash PostToolUse payloads
+        // carry no numeric exit code, so `exitCode === 0` never holds there.
+        // A PostToolUse event with no numeric non-zero exit status counts as
+        // success even when stderr contains diagnostics. Hosts that omit the
+        // lifecycle event name retain the conservative stderr fallback.
         state.lastResolved = { tool: state.tool, timestamp: state.timestamp };
         state.status = 'idle';
         state.timestamp = new Date().toISOString();
@@ -107,8 +113,10 @@ function processState(payload) {
       }
 
       // Milestones for the Stop gate: when did the last mutation happen, and
-      // has any verification-ish command succeeded since.
-      if (toolName === 'Edit' || toolName === 'Write' || toolName === 'apply_patch' || observedMutation) {
+      // has any verification-ish command succeeded since. Direct-tool edits
+      // outside the workspace advance neither milestone (#165).
+      const isDirectTool = toolName === 'Edit' || toolName === 'Write' || toolName === 'apply_patch';
+      if ((isDirectTool && directMutationInWorkspace(payload, cwdOf(payload, root), root)) || observedMutation) {
         state.lastEditAt = Date.now();
       }
       if ((toolName === 'Bash' || toolName === 'PowerShell') && !isFailed) {

package/plugins/harness-everything/hooks/scripts/workflow-gate.js

@@ -4,7 +4,7 @@
 const path = require('path');
 const fs = require('fs');
 const { loadWorkflow, saveWorkflow, isMajorWorkflow, matchingRun, registerMutationProbe, recordBudgetEvent, readHookInput, WORKFLOW_CONTROLLER_COMMANDS } = require('./lib/workflow-runtime');
-const { key, classifyShell, workspaceFingerprint, shellProbeKey, cwdOf, commandOf, mutationPaths, linkedWorktree, assertTargets, assertShellScope } = require('./lib/workflow-isolation');
+const { key, classifyShell, workspaceFingerprint, shellProbeKey, cwdOf, commandOf, mutationPaths, directMutationInWorkspace, linkedWorktree, assertTargets, assertShellScope } = require('./lib/workflow-isolation');
 
 const DIRECT = new Set(['Edit', 'Write', 'apply_patch']);
 const SHELL = new Set(['Bash', 'PowerShell', 'exec_command']);
@@ -48,6 +48,10 @@ function decide(payload) {
     throw new Error('selected Fable workflow has no correlated run. Write workflow-stages.json at the displayed session path, then use workflow-disposition.js start.');
   }
   if (DIRECT.has(tool)) {
+    // Bookkeeping outside the workspace (scratchpad, memory files, temp
+    // notes) is not a workspace mutation: it consumes no Tier-2 iteration
+    // and advances no mutation milestone (#165).
+    if (!directMutationInWorkspace(payload, cwd, root)) return;
     if (workflow.strategy === 'iterative-single') {
       recordBudgetEvent(context, 'iteration', { evidence: `${tool}:direct-mutation` });
     }

package/plugins/harness-everything/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-everything",
-  "version": "0.11.6",
+  "version": "0.11.7",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/skills/harness-everything/SKILL.md

@@ -4,7 +4,7 @@ description: "Route software/project work through the Harness kernel: classify T
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.11.2
+  version: 0.11.7
 ---
 
 # Harness Everything

package/plugins/harness-everything/skills/harness-everything/scripts/kernel-router.js

@@ -33,12 +33,26 @@ function issueMemoryCapability(workflow) {
   return token;
 }
 
+// Host-generated background-task notifications arrive as UserPromptSubmit
+// hook payloads but are not user input (#168). Routing them like prompts
+// replaces the workflow contract mid-turn (e.g. deferred -> a new Tier-2).
+// A prompt that is entirely a notification envelope must never create or
+// replace a workflow; the current contract is kept unchanged.
+function isHostNotificationPrompt(prompt) {
+  const text = String(prompt || '').trim();
+  if (!text) return false;
+  return /^<task-notification[\s>][\s\S]*<\/task-notification>\s*$/i.test(text);
+}
+
 function persistWorkflow(plan, payload, prompt) {
   if (!payload || !(payload.session_id || payload.sessionId)) return null;
   const { runtime, hooksRoot } = loadRuntime();
   const context = runtime.loadWorkflow(payload);
   const { writeCurrentSession } = require(path.join(hooksRoot, 'lib/harness-state'));
   writeCurrentSession(context.root, context.sessionId);
+  if (isHostNotificationPrompt(prompt)) {
+    return { ...context, hooksRoot, retained: true, hostNotification: true };
+  }
   if (context.workflow && runtime.OPEN_STATES.has(context.workflow.state)) {
     if (!context.workflow.workflowPlan) throw new Error('legacy unresolved workflow needs explicit migration; refusing to replace its obligations');
     // Steering/status prompts cannot drop an unresolved execution contract.
@@ -92,17 +106,30 @@ function run(raw) {
     try { payload = JSON.parse(raw); } catch (_) { console.error('[Workflow Router] Invalid hook payload; lifecycle persistence unavailable.'); }
   }
   const prompt = promptArg || (typeof payload?.prompt === 'string' ? payload.prompt : '');
-  const result = core.route(promptArg, raw || null);
-  let plan = result.contract.workflowPlan;
+  const hostNotification = isHostNotificationPrompt(prompt);
+  // Host-generated notifications are lifecycle events, not user-authored task
+  // input. Never feed their text into the router: when there is an active
+  // contract we retain it below; when there is none, the event is a no-op.
+  const result = hostNotification ? null : core.route(promptArg, raw || null);
+  let plan = result?.contract?.workflowPlan || null;
   let persisted = null;
   let failure = null;
   try {
     persisted = persistWorkflow(plan, payload, prompt);
-    if (persisted?.retained) plan = persisted.workflow.workflowPlan;
+    if (persisted?.retained && persisted.workflow) plan = persisted.workflow.workflowPlan;
   } catch (error) { failure = error; }
-  if (result.sanitized) console.log(result.sanitized);
-  if (result.stderr) process.stderr.write(result.stderr);
-  if (persisted?.retained) console.log('\n=> Retaining unresolved workflow from earlier prompts; the checkpoint below is the active execution contract.');
+  if (hostNotification && !persisted?.workflow) {
+    console.log('\n=> Host notification — no active execution contract; ignored for routing.');
+    if (failure) {
+      console.error('[Workflow Router] ' + failure.message);
+      process.exitCode = 2;
+    }
+    return;
+  }
+  if (result?.sanitized) console.log(result.sanitized);
+  if (result?.stderr) process.stderr.write(result.stderr);
+  if (persisted?.hostNotification) console.log('\n=> Host notification — routing unchanged; keeping the active execution contract.');
+  else if (persisted?.retained) console.log('\n=> Retaining unresolved workflow from earlier prompts; the checkpoint below is the active execution contract.');
   core.printWorkflowPlan(plan);
   core.printRoutingCheckpoint(plan);
   core.printKernelContract(plan);
@@ -116,7 +143,7 @@ function run(raw) {
     console.log('   - Tier 3 / Fable source and artifact mutations require Git worktree isolation; unavailable isolation means BLOCKED.');
     console.log('   - Escape is limited to workflow-uncovered-scope or host-capability-unavailable, with stage, scope and evidence; other obligations remain mandatory.');
   }
-  if (persisted) {
+  if (persisted?.workflow) {
     const controller = path.join(persisted.hooksRoot, 'workflow-disposition.js');
     console.log('   - Workflow id: ' + persisted.workflow.workflowId);
     console.log('   - Memory write disposition: ' + (persisted.workflow.workflowPlan.memory?.write || 'none'));
@@ -130,12 +157,13 @@ function run(raw) {
   if (failure) {
     console.error('[Workflow Router] ' + failure.message);
     process.exitCode = 2;
-  } else if (result.status !== 0) process.exitCode = result.status || 1;
+  } else if (result && result.status !== 0) process.exitCode = result.status || 1;
 }
 
+if (typeof module !== 'undefined') module.exports = { isHostNotificationPrompt };
+
 if (process.argv.length > 2 || process.stdin.isTTY) run('');
-else {
-  let input = '';
+else {  let input = '';
   let finished = false;
   const finish = () => { if (finished) return; finished = true; clearTimeout(timeout); run(input); };
   const timeout = setTimeout(finish, 500);

package/docs/issue-20-rollup.md

@@ -1,47 +0,0 @@
-# Issue #20 umbrella rollup
-
-This rollup turns issue #20's historical checklist into bounded acceptance decisions. The review snapshot is `main` at `ba7853b`, checked on 2026-09-07. The umbrella owns coordination and release evidence; implementation details remain with the linked issue.
-
-## Closure status
-
-Issue #20 remains open after this PR. This branch adds deterministic parser,
-collision-gate, plugin-runner, and negative-control coverage, but it does not
-provide live opencode session evidence, a paid behavioral rerun, the proposed
-100-case study, or the three skill-specific improvements below. Those gaps are
-recorded explicitly rather than treated as closed by the deterministic gates.
-
-## Workstream decisions
-
-| Workstream | Evidence in the review snapshot | Acceptance state | Remaining claim boundary |
-| --- | --- | --- | --- |
-| #37 opencode enforcement | The real plugin API is implemented and mechanism coverage exists in `ci/mechanism-2n-opencode-plugin.test.js`; the integrated reflection lifecycle is `d790e7f` on the integration branch. | Integrated, pending final integration gates | No live opencode loading or session smoke evidence was available; do not claim live enforcement. |
-| #52 behavioral transcript parsing | Claude stream fixtures and parser coverage are integrated in `77efb06`; deterministic parser tests are available. | Integrated, pending final integration gates | No new paid behavioral rerun is part of this umbrella. Parse failures and missing tool visibility remain evidence states, not skill failures. |
-| Systematic gate hardening | The local gates now execute real negative controls; YAML frontmatter parsing fails closed in `ci/description-collision.js`, `ci/routing-check.js` skips clearly when waza is absent, and `ci/mechanism-2t-issue-20.test.js` covers CRLF behavioral parsing and plugin validation. | Deterministic hardening integrated | Live platform loading and model behavior remain unverified. |
-| #42 workspace identity and migration | Workspace-keyed state and migration coverage are integrated in `9dd2e3d`; the issue review identified session and migration acceptance as the relevant boundary. | Integrated, pending final integration gates | Do not claim every host/session migration path is live verified until the integration gate and targeted fixtures pass. |
-| #43 multi-agent workspace layout | The reviewed plan makes its root contract depend on #42. No implementation commit was present in the issue #20 review snapshot. | Deferred to its owner | Do not duplicate its layout or runtime work in this umbrella. |
-| #44 progressive disclosure | Documentation and reference checks are integrated in `b33f598`; `ci/disclosure-check.js` and its mechanism coverage are present. | Integrated, pending final integration gates | This records repository documentation evidence; it does not establish behavioral-model effectiveness. |
-| #56 behavioral rubric triage | The review found grader/source-boundary issues, including `command_exit_0` proving the grader command rather than the agent action. | Deferred to its owner | Do not reuse the historical pass-rate claims until the rubric and trace evidence are corrected. |
-| Extended 100-case study | The original issue proposed 100 cases, but the review did not establish a decision threshold or clean attribution between skill text, plugin enforcement, and grader behavior. | Explicitly deferred | No uncontrolled 100-case run is authorized by this rollup. Define paired design, failure taxonomy, and decision rule first. |
-| Five historical baseline failures | The committed 2026-08-27 records show one failed expectation in each of `baseline-debugging` (edge-case consideration), `baseline-performance` (binary-search suggestion), `baseline-security-review` (MD5 identification), `baseline-simple-bugfix` (function understanding), and `verify-before-done` (verification actually run). | Explicitly deferred | These are historical observations, not a new causal investigation or rerun; do not claim they were fixed by this PR. |
-| Skill-specific improvements | No targeted changes were made to `verification-loop`, `zoom-out`, or `security-review` in this branch. | Explicitly deferred | Strengthening verification enforcement, reflection-report detection, and vulnerability detection requires separate design and behavioral evidence. |
-| Release | The tag-triggered full gate and provenance publish workflow already exists. Historical `0.3.6` evidence is recorded in [docs/release-evidence.md](release-evidence.md). | Documentation complete; next release unproven | A prepared `0.3.7-beta` version is not evidence of a tag, npm publication, or GitHub release. |
-
-## Focused acceptance checks
-
-The integration owner should run these checks after incorporating the issue branches:
-
-```text
-npm test
-npm run test:mechanism
-npm run test:consistency
-npm run test:references
-npm run test:release
-npm run test:collision
-npm run test:routing:skills
-```
-
-The checks establish deterministic repository and routing health. They do not substitute for live opencode loading, a paid behavioral run, or npm/GitHub release evidence. Those claims require the artifacts named in [RELEASING.md](../RELEASING.md) and [docs/release-evidence.md](release-evidence.md).
-
-## Historical evidence boundary
-
-The local review artifact `.git/issue-review-20260907/release-evidence.md` records a successful `0.3.6` workflow (`33466676632`) and npm observation. It explicitly says that this is not proof of a `0.3.7-beta` release. This rollup preserves that distinction so an old successful release cannot be mistaken for current publication evidence.

package/docs/reviews/pr-142-issue-131.md

@@ -1,89 +0,0 @@
-# PR #142 / issue #131 completion review
-
-This review covers the implementation in the commit containing this report,
-starting from PR head `8b99baec44745e171f078fe9eb3dac6fd812b5c8`. It evaluates
-Harness engineering and the latest #131 decision, including mandatory mutation
-isolation. It is not a measured agent-performance benchmark.
-
-## Findings resolved
-
-| Original gap | Delivered behavior | Regression evidence |
-| --- | --- | --- |
-| Escape changed the whole workflow state and skipped isolation | Stage-scoped escape; isolation survives legacy escape and blocked states | `mechanism-2af-worktree-isolation.test.js`, `mechanism-2ah-workflow-lifecycle.test.js` |
-| Only cwd was checked | Registered linked checkout of the bound repo; direct/patch targets, move destinations, traversal, and links checked | `mechanism-2af-worktree-isolation.test.js` |
-| Windows runner used 8.3 paths while Git reported long names | Native physical-path resolution equates both spellings without relaxing isolation | Windows path regression and worktree suites |
-| Read-only shell prefixes accepted writes | Reject redirects, substitutions, chained commands and dangerous options; require isolated cwd for mutation/unknown commands | `mechanism-2af-worktree-isolation.test.js` |
-| Next prompt erased unresolved obligations | Stable workflow identity across steering prompts; stronger route requires replan | `mechanism-2ah-workflow-lifecycle.test.js` |
-| Same strategy/timestamp loosely matched any Fable run | Exact workflow, session and run correlation | `mechanism-2ah-workflow-lifecycle.test.js` |
-| Entry gate blocked its own bootstrap path | One bounded stage-specification file and trusted start controller; state/source writes remain gated | `mechanism-2ah-workflow-lifecycle.test.js` |
-| Stop trusted directory contents and pass labels | Expected manifest stages, correlated exit-zero evidence, worker attribution and fresh verifier required | `mechanism-2ah-workflow-lifecycle.test.js` |
-| Stop retry silently passed unresolved work | Retry records blocked; no satisfied state without required evidence | `mechanism-2ah-workflow-lifecycle.test.js` |
-| Failures could not recover cleanly | Observed fail-to-pass checks; explicit bounded replan; retained prior run evidence | `mechanism-2ah-workflow-lifecycle.test.js` |
-| Runtime policy scraped human-readable output | Kernel imports the structured core result; complete invariants persist with the plan | routing tests and lifecycle tests |
-| Current documents contradicted the PR | README, platform matrix, routing, architecture, Fable/worktree references and mirrors aligned | consistency/capability/reference gates |
-| Existing CI selected the first matching hook group | Action-gate regression finds its actual adapter among shared tool matchers | `ci/action-gate.test.js` |
-
-The first added isolation regression run failed 16 assertions against the PR
-baseline, then passed after repair. The baseline's four failing GitHub CI jobs
-also reported the action-gate matcher defect. The initial local checkout lacked
-dependencies, producing a separate CRLF-fixture setup failure; `npm ci` resolved
-that environment prerequisite.
-
-## Verification
-
-Local environment: Windows, PowerShell, Node.js 24.15.0, npm 11.12.1. Work was
-performed in an isolated linked worktree; the primary checkout remained clean.
-
-All 14 required gate categories passed: `npm test`, mutations, mechanism,
-consistency, repository contract, capability docs, references, release,
-collision, positive skill routing, routing invariants, OpenAI package/runtime,
-public submission, and platform compatibility. Failed checks were corrected and
-the affected gates rerun. The final `npm test` includes **44 mechanism suites**.
-
-The new lifecycle suite exercises **50 assertions against source and the same
-50 against the packaged OpenAI layout**, using actual child processes, Git
-repositories, worktrees, controller commands and hook payloads. Host payloads
-are fixtures: these are deterministic mechanism tests, not live agent sessions.
-
-Waza passed 30 canonical/nested skill readiness checks, 26 routing-spec checks,
-and token validation (57 successful commands). Positive routing covered 34
-cases across 26 direct skills and classified four nested skills.
-
-Build/types/lint have no separate project scripts; repository syntax and
-consistency gates apply. No coverage percentage is claimed. The security scanner
-reported 12 pre-existing documentation/test-pattern matches, including its own
-patterns and an explicitly fake token fixture; changed production code added no
-scanner findings. `npm ci` reported zero dependency vulnerabilities. Diff review
-and `git diff --check` passed. See the retained [gate summary](../../benchmarks/results/reviews/pr142-verification.json).
-
-Remote CI is a separate evidence layer. Its result must be read at the final PR
-head; this local record does not assert a future GitHub Actions outcome.
-
-## Reassessment
-
-Scores are review judgments about engineering readiness, each out of 100.
-Each row has four equally weighted criteria (25 points each), with the observed
-deductions shown. They are not success probabilities or benchmark results.
-
-| Dimension | Criteria scores | Total | Remaining deductions |
-| --- | --- | ---: | --- |
-| Contract coherence | entry 22, transitions 23, scoped exceptions 24, docs 23 | 92 | Skill applicability and iterative budgets still partly rely on executor compliance |
-| Mutation safety | worktree identity 23, targets 23, shell handling 17, state trust 12 | 75 | Arbitrary script effects need a host sandbox; runtime state is agent-writable |
-| Deterministic verification | gate breadth 25, negative cases 24, package parity 24, evidence checks 18 | 91 | Host-shaped fixtures cannot establish real host behavior or semantic check quality |
-| Operation and maintenance | entry/recovery 22, modularity 21, distribution 23, diagnostics/migration 18 | 84 | Manual stage setup, missing-metadata blocks and legacy-state repair add operator work |
-
-Equal-weight engineering score: **85.5/100** (approximately **86/100**).
-The system now has substantially stronger tested lifecycle and isolation
-contracts. It is suitable for further host validation with explicit boundaries.
-
-**Live-host reliability of these new gates remains unverified. Behavioral gain
-from this PR remains unmeasured.** Neither receives an invented effectiveness
-score. Older retained OpenCode evidence and older behavioral cases cannot prove
-this workflow change. This review does not claim superiority over other skill
-collections, reduced token cost, or improved task success rates.
-
-The next evidence needed is a retained Claude/Codex session showing routing,
-entry, mutation denial/allow, numeric stage results, worker correlation and Stop
-resolution; then paired same-model/same-task behavioral runs. OpenCode needs its
-own adapter before parity can be claimed. See [runtime limits](../workflow-runtime.md)
-and [platform capabilities](../platform-capabilities.md).