harness-everything 0.11.6 → 0.12.0

package/to-spec/templates/feature-spec.md

@@ -56,4 +56,18 @@ A description of the things that are out of scope for this spec.
 
 Any further notes about the feature.
 
+## Contract Requirements
+
+For every normative behavior this document owns, assign a stable requirement identity:
+
+```md
+### REQ-001 — <short behavior name>
+**Status:** CURRENT
+**Revision:** 1
+**Decision lineage:** ADR-0001 (or None)
+<observable behavior / acceptance boundary>
+```
+
+Do not recycle requirement IDs. When approved behavior changes, increment the revision and reconcile the living spec before implementation completion.
+
 </spec-template>

package/to-spec/templates/schema-doc.md

@@ -28,4 +28,18 @@ What breaks for existing consumers, if anything, and what the mitigation is (dua
 
 One realistic, complete example instance of the schema.
 
+## Contract Requirements
+
+For every normative schema behavior this document owns, assign a stable requirement identity:
+
+```md
+### REQ-001 — <short behavior name>
+**Status:** CURRENT
+**Revision:** 1
+**Decision lineage:** ADR-0001 (or None)
+<observable validation, compatibility, or migration contract>
+```
+
+Do not recycle requirement IDs. A changed schema/validation contract increments the revision before implementation completion.
+
 </spec-template>

package/to-tickets/SKILL.md

@@ -4,7 +4,7 @@ description: Break a to-spec feature-spec, a plan, or a conversation into tracer
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.4.0
+  version: 0.12.0
 ---
 
 # To Tickets

package/to-tickets/references/publishing-and-templates.md

@@ -48,6 +48,19 @@ Give each ticket its **blocking edges** — the other tickets that must complete
 
 **Wide refactors are the exception to vertical slicing.** A **wide refactor** is one mechanical change — rename a column, retype a shared symbol — whose **blast radius** fans across the whole codebase, so a single edit breaks thousands of call sites at once and no vertical slice can land green. Don't force it into a tracer bullet; sequence it as **expand–contract**. First expand: add the new form beside the old so nothing breaks. Then migrate the call sites over in batches sized by blast radius (per package, per directory), each batch its own ticket blocked by the expand, keeping CI green batch to batch because the old form still exists. Finally contract: delete the old form once no caller remains, in a ticket blocked by every migrate batch. When even the batches can't stay green alone, keep the sequence but let them share an integration branch that all block a final integrate-and-verify ticket — green is promised only there.
 
+# Contract lineage and change impact
+
+When a ticket comes from an authoritative spec, it must carry the exact source requirement identity and revision. A ticket may refine implementation scope, but it never silently rewrites the approved contract.
+
+Every ticket must classify its impact:
+
+- **none** — bookkeeping/non-behavioral work; explain why no contract changes.
+- **implementation** — implementation changes while approved behavior and architectural rationale stay unchanged.
+- **behavior** — caller/user-visible behavior changes. Update the living spec requirement and revision first, then obtain requirement-linked RED evidence before accepting implementation.
+- **architecture** — a hard-to-reverse decision/rationale changes. Publish a new/superseding ADR, update the living spec requirement/revision, then obtain RED evidence.
+
+If the impact classification changes during implementation, stop treating the original ticket as completion authority. Reconcile the source artifacts first, then update the ticket's source revision.
+
 # Ticket Templates
 
 <local-ticket-template>
@@ -58,9 +71,15 @@ Give each ticket its **blocking edges** — the other tickets that must complete
 
 **Blocked by:** the numbers/titles of the tickets that gate this one, or "None — can start immediately".
 
+**Source requirements:** `REQ-001@rev1` (add every requirement this ticket changes or proves).
+
+**Change impact:** `none | implementation | behavior | architecture`
+
+**Impact rationale:** one sentence explaining why this classification is correct.
+
 **Status:** ready-for-agent
 
-- [ ] Acceptance criterion 1
+- [ ] [REQ-001] Acceptance criterion 1
 - [ ] Acceptance criterion 2
 
 </local-ticket-template>

package/verification-loop/SKILL.md

@@ -4,7 +4,7 @@ description: "Run objective verification gates (build, types, lint, tests, secur
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.4.0
+  version: 0.12.0
 ---
 
 # Verification Loop
@@ -41,6 +41,7 @@ and rerun from the first affected gate.
 4. Tests and coverage: `npm run test -- --coverage`.
 5. Security scan: secrets and stray logs.
 6. Diff review: `git diff --stat` and unintended-change checks.
-7. Fill `<this-skill-dir>/templates/verification-report.template.md` with evidence.
+7. Contract reconciliation when the work cites `REQ-*` / ADR/spec/ticket lineage or a contract-integrity trace exists: run the strict `<this-skill-dir>/scripts/contract-integrity-audit.js` gate with current #58 evidence. `AUDIT`, `NOT_EVALUATED`, stale source binding, or drift is **not ready** for delivery.
+8. Fill `<this-skill-dir>/templates/verification-report.template.md` with evidence.
 
 Deep dive: `<this-skill-dir>/references/verification-phases.md`

package/verification-loop/references/verification-phases.md

@@ -10,8 +10,14 @@ flowchart TD
     Lint --> Test[4. Phase 4: Test Suite Execution]
     Test --> Security[5. Phase 5: Security & Secret Scan]
     Security --> Diff[6. Phase 6: Diff Review]
+    Diff --> Contract{7. Contract lineage applicable?}
+    Contract -- Yes --> Reconcile[Run contract-integrity strict reconciliation]
+    Contract -- No --> CheckScript
+    Reconcile --> ContractResult{PASS?}
+    ContractResult -- No --> Fix
+    ContractResult -- Yes --> CheckScript
     
-    Diff --> CheckScript{7. Is verify-gate.js / Template Available?}
+    Diff --> CheckScript{8. Is verify-gate.js / Template Available?}
     
     CheckScript -- Yes --> RunScript[Run harness-everything/scripts/verify-gate.js / Fill verification-report.template.md]
     CheckScript -- No --> DirectReport[Output Verification Report Inline in Response]
@@ -93,6 +99,24 @@ Review each changed file for:
 - Missing error handling
 - Potential edge cases
 
+## Phase 7: Contract Reconciliation
+
+This phase is applicable when any of the following is true:
+
+- the task/spec/ticket cites stable `REQ-*` identities;
+- an ADR/spec/ticket change is classified as `behavior` or `architecture`;
+- the project has a contract-integrity trace for the affected scope.
+
+Use the current trace plus current #58 TDD evidence:
+
+```bash
+node "<this-skill-dir>/scripts/contract-integrity-audit.js" <trace.json> --tdd-evidence <tdd-evidence.json> --output <report.json> --markdown <report.md>
+```
+
+Delivery requires strict **PASS**. Treat `FAIL`, `AUDIT`, `NOT_EVALUATED`, source conflicts/defects, stale spec/test/implementation lineage, surviving required probes, and audit-only output as **NOT READY**. Do not downgrade the gate merely because build/tests are otherwise green.
+
+If this phase is not applicable, record `NOT_APPLICABLE` with a one-line reason. Never use `NOT_APPLICABLE` to hide known requirement lineage.
+
 ## Output Format
 
 After running all phases, fill in `verification-loop/templates/verification-report.template.md` with the actual results and present it.

package/verification-loop/scripts/contract-integrity-audit.js

@@ -0,0 +1,31 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+function resolveAuditRuntime() {
+  const candidates = [
+    path.resolve(__dirname, '../../contract-integrity/scripts/audit.js'),
+    path.resolve(__dirname, '../../../contract-integrity/scripts/audit.js'),
+  ];
+  for (const candidate of candidates) {
+    if (fs.existsSync(candidate)) return candidate;
+  }
+  throw new Error('contract-integrity audit runtime is not packaged with this verification-loop installation');
+}
+
+function main() {
+  try {
+    const target = resolveAuditRuntime();
+    const { runCli } = require(target);
+    if (typeof runCli !== 'function') throw new Error('contract-integrity audit runtime does not export runCli');
+    process.exitCode = runCli([process.execPath, target, ...process.argv.slice(2)]);
+  } catch (error) {
+    console.error('[Verification Contract Gate] ' + error.message);
+    process.exitCode = 2;
+  }
+}
+
+if (require.main === module) main();
+module.exports = { resolveAuditRuntime };

package/verification-loop/templates/verification-report.template.md

@@ -7,6 +7,9 @@ Lint:      [PASS/FAIL] (X warnings)
 Tests:     [PASS/FAIL] (X/Y passed, Z% coverage)
 Security:  [PASS/FAIL] (X issues)
 Diff:      [X files changed]
+Contract:  [PASS/FAIL/NOT_APPLICABLE] (REQ IDs / trace report / reason)
+            Strict PASS required when contract lineage is applicable.
+            AUDIT or NOT_EVALUATED is NOT READY.
 
 Overall:   [READY/NOT READY] for PR
 

package/docs/issue-20-rollup.md

@@ -1,47 +0,0 @@
-# Issue #20 umbrella rollup
-
-This rollup turns issue #20's historical checklist into bounded acceptance decisions. The review snapshot is `main` at `ba7853b`, checked on 2026-09-07. The umbrella owns coordination and release evidence; implementation details remain with the linked issue.
-
-## Closure status
-
-Issue #20 remains open after this PR. This branch adds deterministic parser,
-collision-gate, plugin-runner, and negative-control coverage, but it does not
-provide live opencode session evidence, a paid behavioral rerun, the proposed
-100-case study, or the three skill-specific improvements below. Those gaps are
-recorded explicitly rather than treated as closed by the deterministic gates.
-
-## Workstream decisions
-
-| Workstream | Evidence in the review snapshot | Acceptance state | Remaining claim boundary |
-| --- | --- | --- | --- |
-| #37 opencode enforcement | The real plugin API is implemented and mechanism coverage exists in `ci/mechanism-2n-opencode-plugin.test.js`; the integrated reflection lifecycle is `d790e7f` on the integration branch. | Integrated, pending final integration gates | No live opencode loading or session smoke evidence was available; do not claim live enforcement. |
-| #52 behavioral transcript parsing | Claude stream fixtures and parser coverage are integrated in `77efb06`; deterministic parser tests are available. | Integrated, pending final integration gates | No new paid behavioral rerun is part of this umbrella. Parse failures and missing tool visibility remain evidence states, not skill failures. |
-| Systematic gate hardening | The local gates now execute real negative controls; YAML frontmatter parsing fails closed in `ci/description-collision.js`, `ci/routing-check.js` skips clearly when waza is absent, and `ci/mechanism-2t-issue-20.test.js` covers CRLF behavioral parsing and plugin validation. | Deterministic hardening integrated | Live platform loading and model behavior remain unverified. |
-| #42 workspace identity and migration | Workspace-keyed state and migration coverage are integrated in `9dd2e3d`; the issue review identified session and migration acceptance as the relevant boundary. | Integrated, pending final integration gates | Do not claim every host/session migration path is live verified until the integration gate and targeted fixtures pass. |
-| #43 multi-agent workspace layout | The reviewed plan makes its root contract depend on #42. No implementation commit was present in the issue #20 review snapshot. | Deferred to its owner | Do not duplicate its layout or runtime work in this umbrella. |
-| #44 progressive disclosure | Documentation and reference checks are integrated in `b33f598`; `ci/disclosure-check.js` and its mechanism coverage are present. | Integrated, pending final integration gates | This records repository documentation evidence; it does not establish behavioral-model effectiveness. |
-| #56 behavioral rubric triage | The review found grader/source-boundary issues, including `command_exit_0` proving the grader command rather than the agent action. | Deferred to its owner | Do not reuse the historical pass-rate claims until the rubric and trace evidence are corrected. |
-| Extended 100-case study | The original issue proposed 100 cases, but the review did not establish a decision threshold or clean attribution between skill text, plugin enforcement, and grader behavior. | Explicitly deferred | No uncontrolled 100-case run is authorized by this rollup. Define paired design, failure taxonomy, and decision rule first. |
-| Five historical baseline failures | The committed 2026-08-27 records show one failed expectation in each of `baseline-debugging` (edge-case consideration), `baseline-performance` (binary-search suggestion), `baseline-security-review` (MD5 identification), `baseline-simple-bugfix` (function understanding), and `verify-before-done` (verification actually run). | Explicitly deferred | These are historical observations, not a new causal investigation or rerun; do not claim they were fixed by this PR. |
-| Skill-specific improvements | No targeted changes were made to `verification-loop`, `zoom-out`, or `security-review` in this branch. | Explicitly deferred | Strengthening verification enforcement, reflection-report detection, and vulnerability detection requires separate design and behavioral evidence. |
-| Release | The tag-triggered full gate and provenance publish workflow already exists. Historical `0.3.6` evidence is recorded in [docs/release-evidence.md](release-evidence.md). | Documentation complete; next release unproven | A prepared `0.3.7-beta` version is not evidence of a tag, npm publication, or GitHub release. |
-
-## Focused acceptance checks
-
-The integration owner should run these checks after incorporating the issue branches:
-
-```text
-npm test
-npm run test:mechanism
-npm run test:consistency
-npm run test:references
-npm run test:release
-npm run test:collision
-npm run test:routing:skills
-```
-
-The checks establish deterministic repository and routing health. They do not substitute for live opencode loading, a paid behavioral run, or npm/GitHub release evidence. Those claims require the artifacts named in [RELEASING.md](../RELEASING.md) and [docs/release-evidence.md](release-evidence.md).
-
-## Historical evidence boundary
-
-The local review artifact `.git/issue-review-20260907/release-evidence.md` records a successful `0.3.6` workflow (`33466676632`) and npm observation. It explicitly says that this is not proof of a `0.3.7-beta` release. This rollup preserves that distinction so an old successful release cannot be mistaken for current publication evidence.

package/docs/reviews/pr-142-issue-131.md

@@ -1,89 +0,0 @@
-# PR #142 / issue #131 completion review
-
-This review covers the implementation in the commit containing this report,
-starting from PR head `8b99baec44745e171f078fe9eb3dac6fd812b5c8`. It evaluates
-Harness engineering and the latest #131 decision, including mandatory mutation
-isolation. It is not a measured agent-performance benchmark.
-
-## Findings resolved
-
-| Original gap | Delivered behavior | Regression evidence |
-| --- | --- | --- |
-| Escape changed the whole workflow state and skipped isolation | Stage-scoped escape; isolation survives legacy escape and blocked states | `mechanism-2af-worktree-isolation.test.js`, `mechanism-2ah-workflow-lifecycle.test.js` |
-| Only cwd was checked | Registered linked checkout of the bound repo; direct/patch targets, move destinations, traversal, and links checked | `mechanism-2af-worktree-isolation.test.js` |
-| Windows runner used 8.3 paths while Git reported long names | Native physical-path resolution equates both spellings without relaxing isolation | Windows path regression and worktree suites |
-| Read-only shell prefixes accepted writes | Reject redirects, substitutions, chained commands and dangerous options; require isolated cwd for mutation/unknown commands | `mechanism-2af-worktree-isolation.test.js` |
-| Next prompt erased unresolved obligations | Stable workflow identity across steering prompts; stronger route requires replan | `mechanism-2ah-workflow-lifecycle.test.js` |
-| Same strategy/timestamp loosely matched any Fable run | Exact workflow, session and run correlation | `mechanism-2ah-workflow-lifecycle.test.js` |
-| Entry gate blocked its own bootstrap path | One bounded stage-specification file and trusted start controller; state/source writes remain gated | `mechanism-2ah-workflow-lifecycle.test.js` |
-| Stop trusted directory contents and pass labels | Expected manifest stages, correlated exit-zero evidence, worker attribution and fresh verifier required | `mechanism-2ah-workflow-lifecycle.test.js` |
-| Stop retry silently passed unresolved work | Retry records blocked; no satisfied state without required evidence | `mechanism-2ah-workflow-lifecycle.test.js` |
-| Failures could not recover cleanly | Observed fail-to-pass checks; explicit bounded replan; retained prior run evidence | `mechanism-2ah-workflow-lifecycle.test.js` |
-| Runtime policy scraped human-readable output | Kernel imports the structured core result; complete invariants persist with the plan | routing tests and lifecycle tests |
-| Current documents contradicted the PR | README, platform matrix, routing, architecture, Fable/worktree references and mirrors aligned | consistency/capability/reference gates |
-| Existing CI selected the first matching hook group | Action-gate regression finds its actual adapter among shared tool matchers | `ci/action-gate.test.js` |
-
-The first added isolation regression run failed 16 assertions against the PR
-baseline, then passed after repair. The baseline's four failing GitHub CI jobs
-also reported the action-gate matcher defect. The initial local checkout lacked
-dependencies, producing a separate CRLF-fixture setup failure; `npm ci` resolved
-that environment prerequisite.
-
-## Verification
-
-Local environment: Windows, PowerShell, Node.js 24.15.0, npm 11.12.1. Work was
-performed in an isolated linked worktree; the primary checkout remained clean.
-
-All 14 required gate categories passed: `npm test`, mutations, mechanism,
-consistency, repository contract, capability docs, references, release,
-collision, positive skill routing, routing invariants, OpenAI package/runtime,
-public submission, and platform compatibility. Failed checks were corrected and
-the affected gates rerun. The final `npm test` includes **44 mechanism suites**.
-
-The new lifecycle suite exercises **50 assertions against source and the same
-50 against the packaged OpenAI layout**, using actual child processes, Git
-repositories, worktrees, controller commands and hook payloads. Host payloads
-are fixtures: these are deterministic mechanism tests, not live agent sessions.
-
-Waza passed 30 canonical/nested skill readiness checks, 26 routing-spec checks,
-and token validation (57 successful commands). Positive routing covered 34
-cases across 26 direct skills and classified four nested skills.
-
-Build/types/lint have no separate project scripts; repository syntax and
-consistency gates apply. No coverage percentage is claimed. The security scanner
-reported 12 pre-existing documentation/test-pattern matches, including its own
-patterns and an explicitly fake token fixture; changed production code added no
-scanner findings. `npm ci` reported zero dependency vulnerabilities. Diff review
-and `git diff --check` passed. See the retained [gate summary](../../benchmarks/results/reviews/pr142-verification.json).
-
-Remote CI is a separate evidence layer. Its result must be read at the final PR
-head; this local record does not assert a future GitHub Actions outcome.
-
-## Reassessment
-
-Scores are review judgments about engineering readiness, each out of 100.
-Each row has four equally weighted criteria (25 points each), with the observed
-deductions shown. They are not success probabilities or benchmark results.
-
-| Dimension | Criteria scores | Total | Remaining deductions |
-| --- | --- | ---: | --- |
-| Contract coherence | entry 22, transitions 23, scoped exceptions 24, docs 23 | 92 | Skill applicability and iterative budgets still partly rely on executor compliance |
-| Mutation safety | worktree identity 23, targets 23, shell handling 17, state trust 12 | 75 | Arbitrary script effects need a host sandbox; runtime state is agent-writable |
-| Deterministic verification | gate breadth 25, negative cases 24, package parity 24, evidence checks 18 | 91 | Host-shaped fixtures cannot establish real host behavior or semantic check quality |
-| Operation and maintenance | entry/recovery 22, modularity 21, distribution 23, diagnostics/migration 18 | 84 | Manual stage setup, missing-metadata blocks and legacy-state repair add operator work |
-
-Equal-weight engineering score: **85.5/100** (approximately **86/100**).
-The system now has substantially stronger tested lifecycle and isolation
-contracts. It is suitable for further host validation with explicit boundaries.
-
-**Live-host reliability of these new gates remains unverified. Behavioral gain
-from this PR remains unmeasured.** Neither receives an invented effectiveness
-score. Older retained OpenCode evidence and older behavioral cases cannot prove
-this workflow change. This review does not claim superiority over other skill
-collections, reduced token cost, or improved task success rates.
-
-The next evidence needed is a retained Claude/Codex session showing routing,
-entry, mutation denial/allow, numeric stage results, worker correlation and Stop
-resolution; then paired same-model/same-task behavioral runs. OpenCode needs its
-own adapter before parity can be claimed. See [runtime limits](../workflow-runtime.md)
-and [platform capabilities](../platform-capabilities.md).