harness-everything 0.11.6 → 0.12.0

package/ci/mechanism-32-paired-benchmark.test.js

@@ -6,8 +6,11 @@ const crypto = require('crypto');
 const helper = require('./test-helper');
 const {
   mcnemarExactP,
+  pairContract,
   prepareArmWorkspace,
+  retrieveLesson,
   summarizePairs,
+  validateLessonCase,
   validatePairRecord,
   validateRunConfig,
 } = require('../behavioral-evals/paired-benchmark');
@@ -142,6 +145,142 @@ try {
   fs.rmSync(pluginBaseline.ws, { recursive: true, force: true });
   fs.rmSync(pluginTreatment.ws, { recursive: true, force: true });
 
+  const lessonCase = {
+    id: 'lesson-retrieval-shape',
+    discipline: 'verify-before-claim',
+    loaded_skills: ['verify-before-claim'],
+    prompt: 'npm test is failing for higher retry attempts. Fix it and verify.',
+    max_turns: 8,
+    fixture: { files: [{ path: 'probe.txt', content: 'baseline\n' }] },
+    expectations: [{ type: 'file_contains', path: 'probe.txt', value: 'baseline' }],
+    lesson: {
+      candidate_id: 'lesson-0123456789abcdef01234567',
+      rule: 'When retry delay tests fail at higher attempts, inspect exponential backoff before changing caps and verify with npm test.',
+      scope_task: 'retry delay exponential backoff higher attempts npm test',
+      query_task: 'retry delay exponential backoff higher attempts npm test',
+    },
+  };
+  helper.check(
+    '32. lesson-retrieval case requires a valid accepted-lesson fixture contract',
+    validateLessonCase(lessonCase).length === 0,
+    validateLessonCase(lessonCase).join('; '),
+  );
+  const lessonConfigProblems = validateRunConfig({
+    effect_type: 'lesson-retrieval', engine: 'claude', model: 'test/model',
+    min_effect_pp: 10, repeats: 1,
+  });
+  helper.check(
+    '32. lesson-retrieval is an explicit paired effect type rather than being disguised as skill-text',
+    lessonConfigProblems.length === 0,
+    lessonConfigProblems.join('; '),
+  );
+
+  const lessonBaselinePrepared = prepareArmWorkspace(lessonCase, 'lesson-retrieval', 'baseline', 'claude');
+  const lessonTreatmentPrepared = prepareArmWorkspace(lessonCase, 'lesson-retrieval', 'treatment', 'claude');
+  const lessonStateBaseline = helper.tempDir('.paired-lesson-state-baseline');
+  const lessonStateTreatment = helper.tempDir('.paired-lesson-state-treatment');
+  const baselineLesson = retrieveLesson(
+    lessonCase, lessonBaselinePrepared.memoryStore, lessonStateBaseline, false,
+  );
+  const treatmentLesson = retrieveLesson(
+    lessonCase, lessonTreatmentPrepared.memoryStore, lessonStateTreatment, true,
+  );
+  helper.check(
+    '32. lesson memory store stays outside both agent workspaces',
+    !lessonBaselinePrepared.memoryStore.startsWith(lessonBaselinePrepared.ws + path.sep) &&
+      !lessonTreatmentPrepared.memoryStore.startsWith(lessonTreatmentPrepared.ws + path.sep) &&
+      !fs.existsSync(path.join(lessonBaselinePrepared.ws, 'memories')) &&
+      !fs.existsSync(path.join(lessonTreatmentPrepared.ws, 'memories')),
+    JSON.stringify({ baseline: lessonBaselinePrepared, treatment: lessonTreatmentPrepared }),
+  );
+  helper.check(
+    '32. both arms execute the same scoped retrieval while only treatment receives the context',
+    baselineLesson.evidence.queried === true &&
+      treatmentLesson.evidence.queried === true &&
+      baselineLesson.evidence.exposed === false &&
+      treatmentLesson.evidence.exposed === true &&
+      baselineLesson.evidence.retrieval_set_sha256 === treatmentLesson.evidence.retrieval_set_sha256 &&
+      JSON.stringify(baselineLesson.evidence.candidate_ids) === JSON.stringify(treatmentLesson.evidence.candidate_ids) &&
+      baselineLesson.prompt === lessonCase.prompt &&
+      treatmentLesson.prompt.includes('Harness scoped memory context') &&
+      treatmentLesson.prompt.includes(lessonCase.lesson.candidate_id),
+    JSON.stringify({ baseline: baselineLesson.evidence, treatment: treatmentLesson.evidence }),
+  );
+
+  const lessonContract = pairContract(lessonCase, {
+    effect_type: 'lesson-retrieval',
+    engine: 'claude',
+    model: 'test/model',
+  });
+  const lessonPair = {
+    schema_version: 1,
+    id: lessonCase.id,
+    pair_id: 'lesson-pair',
+    effect_type: 'lesson-retrieval',
+    contract: lessonContract,
+    contract_sha256: hash(lessonContract),
+    arms: {
+      baseline: {
+        ...arm('fail', true),
+        intervention: { skill_text: true, plugin_enforcement: false, lesson_retrieval: false },
+        loaded_skills: ['verify-before-claim'],
+        lesson_retrieval: baselineLesson.evidence,
+      },
+      treatment: {
+        ...arm('pass', true),
+        intervention: { skill_text: true, plugin_enforcement: false, lesson_retrieval: true },
+        loaded_skills: ['verify-before-claim'],
+        lesson_retrieval: treatmentLesson.evidence,
+      },
+    },
+  };
+  helper.check(
+    '32. attributed lesson-retrieval pair is includable only with constant skill text and identical retrieval set',
+    validatePairRecord(lessonPair).included,
+    JSON.stringify(validatePairRecord(lessonPair)),
+  );
+  const lessonSetMismatch = JSON.parse(JSON.stringify(lessonPair));
+  lessonSetMismatch.pair_id = 'lesson-set-mismatch';
+  lessonSetMismatch.arms.treatment.lesson_retrieval.retrieval_set_sha256 = 'different';
+  helper.check(
+    '32. mismatched memory retrieval set excludes the pair instead of counting it as lesson effect',
+    !validatePairRecord(lessonSetMismatch).included &&
+      validatePairRecord(lessonSetMismatch).reason === 'lesson-retrieval-set-mismatch',
+    JSON.stringify(validatePairRecord(lessonSetMismatch)),
+  );
+  const lessonTrustMissing = JSON.parse(JSON.stringify(lessonPair));
+  lessonTrustMissing.pair_id = 'lesson-trust-missing';
+  lessonTrustMissing.arms.treatment.lesson_retrieval.trust_boundary = null;
+  helper.check(
+    '32. treatment without the untrusted-memory boundary is excluded from causal evidence',
+    !validatePairRecord(lessonTrustMissing).included &&
+      validatePairRecord(lessonTrustMissing).reason === 'lesson-trust-boundary-missing',
+    JSON.stringify(validatePairRecord(lessonTrustMissing)),
+  );
+  const lessonContextTamper = JSON.parse(JSON.stringify(lessonPair));
+  lessonContextTamper.pair_id = 'lesson-context-tamper';
+  lessonContextTamper.arms.treatment.lesson_retrieval.context_sha256 = 'tampered';
+  helper.check(
+    '32. changed lesson exposure text invalidates the predeclared pair contract',
+    !validatePairRecord(lessonContextTamper).included &&
+      validatePairRecord(lessonContextTamper).reason === 'lesson-context-hash-mismatch',
+    JSON.stringify(validatePairRecord(lessonContextTamper)),
+  );
+
+  for (const target of [
+    lessonBaselinePrepared.ws, lessonTreatmentPrepared.ws,
+    lessonBaselinePrepared.memoryStore, lessonTreatmentPrepared.memoryStore,
+    lessonStateBaseline, lessonStateTreatment,
+  ]) fs.rmSync(target, { recursive: true, force: true });
+
+  const invalidLesson = JSON.parse(JSON.stringify(lessonCase));
+  invalidLesson.lesson.candidate_id = 'not-a-lesson-id';
+  helper.check(
+    '32. malformed lesson provenance is rejected before any live model call',
+    validateLessonCase(invalidLesson).some(problem => problem.includes('candidate_id')),
+    validateLessonCase(invalidLesson).join('; '),
+  );
+
   const validSkillPair = skillPair('p1', 'fail', 'pass');
   helper.check('32. a correctly isolated skill-text pair is includable', validatePairRecord(validSkillPair).included, JSON.stringify(validatePairRecord(validSkillPair)));
 

package/ci/openai-plugin-package.test.js

@@ -112,6 +112,23 @@ for (const entry of SOURCE_MANIFEST.skills) {
   assertTreesEqual(source, path.join(PLUGIN, 'skills', name), name);
 }
 
+const packagedContractAudit = path.join(PLUGIN, 'contract-integrity', 'scripts', 'audit.js');
+assert.ok(fs.existsSync(packagedContractAudit), 'OpenAI package must include shared contract-integrity runtime outside skills/');
+const packagedAuditSource = fs.readFileSync(packagedContractAudit, 'utf8');
+assert.match(packagedAuditSource, /skills\/tdd\/scripts\/quality-gate/, 'packaged contract audit must resolve #58 evaluator from packaged tdd skill');
+assert.doesNotMatch(packagedAuditSource, /\.\.\/\.\.\/tdd\/scripts\/quality-gate/, 'packaged contract audit must not retain canonical repo-only TDD import');
+const packagedAudit = require(packagedContractAudit);
+assert.strictEqual(typeof packagedAudit.runCli, 'function', 'packaged contract audit runtime must load and export runCli');
+
+const verificationContractWrapper = path.join(PLUGIN, 'skills', 'verification-loop', 'scripts', 'contract-integrity-audit.js');
+assert.ok(fs.existsSync(verificationContractWrapper), 'verification-loop must package its contract audit wrapper');
+const verificationWrapper = require(verificationContractWrapper);
+assert.strictEqual(
+  verificationWrapper.resolveAuditRuntime(),
+  packagedContractAudit,
+  'packaged verification-loop wrapper must resolve the plugin-root contract audit runtime'
+);
+
 const marketplace = JSON.parse(fs.readFileSync(path.join(ROOT, '.agents', 'plugins', 'marketplace.json'), 'utf8'));
 assert.strictEqual(marketplace.name, 'harness-everything', 'marketplace should use the publication name, not a local-only label');
 assert.strictEqual(marketplace.interface?.displayName, 'Harness Everything');

package/ci/self-evolve-loop.test.js

@@ -55,8 +55,10 @@ const {
   createLearningOpportunity,
 } = require(path.join(ROOT, 'hooks/scripts/lib/learning-opportunity.js'));
 const { retrieveMemoryRecords } = require(path.join(ROOT, 'multi-agent-workspace/scripts/index_memory.js'));
+const telemetry = require(path.join(ROOT, 'hooks/scripts/lib/telemetry.js'));
+const { buildReport } = require(path.join(ROOT, 'telemetry/scripts/report.js'));
 
-console.log('=== #141 Self-Evolve Closed Loop Phase 1-3 ===');
+console.log('=== #141 Self-Evolve Closed Loop Phase 1-4 Mechanism ===');
 
 try {
   const tracker = path.join(ROOT, 'hooks/scripts/rule-of-3-tracker.js');
@@ -248,6 +250,15 @@ try {
   }).candidate;
   check(retrievedState.state === 'retrieved' && retrievedState.outcome.evidenceRef === 'retrieval-fixture:REQ-141', 'later retrieval can advance the candidate lifecycle with evidence');
 
+  const validatedState = observeCandidate({
+    workspace,
+    sessionId: verifySession,
+    candidateId: verifyCandidate.candidateId,
+    outcome: 'validated',
+    evidence: 'paired-or-later-outcome-fixture:REQ-141',
+  }).candidate;
+  check(validatedState.state === 'validated', 'later outcome evidence can advance a retrieved lesson to validated');
+
   const duplicate = createLearningOpportunity({
     session_id: ruleSession,
     cwd: workspace,
@@ -287,6 +298,30 @@ try {
   check(sourceHook.includes('createLearningOpportunity') && verifierHook.includes('createLearningOpportunity'), 'negative-control anchors require both runtime emitters');
   check(!sourceHook.includes('persistMemory(') && !verifierHook.includes('persistMemory('), 'runtime recovery hooks cannot directly persist memory');
 
+  const telemetryEvents = telemetry.readEvents(telemetry.telemetryFile(workspace, { cwd: workspace }));
+  const telemetryReport = buildReport(telemetryEvents);
+  const lessonEvents = new Set(telemetryEvents.filter(event => !event.invalid).map(event => event.event));
+  for (const expected of [
+    'learning_opportunity', 'lesson_proposed', 'lesson_screened', 'lesson_evaluated',
+    'lesson_accepted', 'lesson_rejected', 'lesson_inconclusive', 'lesson_persisted',
+    'lesson_retrieved', 'lesson_validated',
+  ]) {
+    check(lessonEvents.has(expected), 'self-evolve lifecycle emits telemetry event: ' + expected);
+  }
+  check(telemetryReport.selfEvolve.funnel.opportunities >= 3 &&
+    telemetryReport.selfEvolve.funnel.accepted >= 1 &&
+    telemetryReport.selfEvolve.funnel.inconclusive >= 1 &&
+    telemetryReport.selfEvolve.funnel.rejected >= 1 &&
+    telemetryReport.selfEvolve.funnel.persisted >= 1 &&
+    telemetryReport.selfEvolve.funnel.retrieved >= 1 &&
+    telemetryReport.selfEvolve.funnel.validated >= 1,
+    'telemetry report exposes opportunity -> disposition -> persisted -> retrieved -> validated funnel');
+  const telemetryText = fs.readFileSync(telemetry.telemetryFile(workspace, { cwd: workspace }), 'utf8');
+  check(!telemetryText.includes('Always verify recovery.test.js') &&
+    !telemetryText.includes('retrieval-fixture:REQ-141') &&
+    !telemetryText.includes('SECRET_OUTPUT_SHOULD_NOT_BE_RETAINED'),
+    'lesson telemetry excludes generalized rules, evidence refs, and raw runtime output');
+
   const lessonSchema = JSON.parse(fs.readFileSync(path.join(ROOT, 'self-evolve/schemas/lesson-candidate.schema.json'), 'utf8'));
   check(lessonSchema.properties?.state?.enum?.includes('inconclusive') && lessonSchema.properties?.trigger?.properties?.type?.enum?.includes('verifier-fail-pass'), 'versioned lesson schema covers lifecycle and trigger vocabulary');
 
@@ -307,5 +342,5 @@ try {
   fs.rmSync(tempRoot, { recursive: true, force: true });
 }
 
-console.log(`\n${failed === 0 ? 'PASS' : 'FAIL'}: #141 self-evolve closed loop phase 1-3 (${failed} failure${failed === 1 ? '' : 's'})`);
+console.log(`\n${failed === 0 ? 'PASS' : 'FAIL'}: #141 self-evolve closed loop phase 1-4 mechanism (${failed} failure${failed === 1 ? '' : 's'})`);
 process.exit(failed === 0 ? 0 : 1);

package/ci/telemetry.test.js

@@ -102,6 +102,32 @@ async function main() {
     check(report.skills[0].invocationCount === 1 && report.skills[0].toolEventCount === 1, 'aggregation retains invocation and attributed-tool counts');
     check(report.semantics.activeWindowMs.includes('not CPU'), 'report documents active-window semantics instead of calling it runtime');
 
+    const lessonId = 'lesson-0123456789abcdef01234567';
+    for (const event of ['learning_opportunity', 'lesson_proposed', 'lesson_screened', 'lesson_evaluated', 'lesson_accepted', 'lesson_persisted', 'lesson_retrieved']) {
+      const emitted = telemetry.emitLessonTelemetry({
+        event,
+        root: workspace,
+        sessionId: session,
+        candidateId: lessonId,
+        status: 'success',
+        reasonCodes: ['fixture-lifecycle'],
+      });
+      check(emitted.ok === true, 'lesson lifecycle telemetry accepts privacy-safe event: ' + event);
+    }
+    const lifecycleEvents = telemetry.readEvents(file);
+    const lifecycleReport = buildReport(lifecycleEvents);
+    check(lifecycleReport.skills.length === 1 && lifecycleReport.skills[0].skillName === 'tdd',
+      'lesson lifecycle events do not contaminate skill execution aggregates');
+    check(lifecycleReport.selfEvolve.candidateCount === 1 &&
+      lifecycleReport.selfEvolve.funnel.opportunities === 1 &&
+      lifecycleReport.selfEvolve.funnel.accepted === 1 &&
+      lifecycleReport.selfEvolve.funnel.persisted === 1 &&
+      lifecycleReport.selfEvolve.funnel.retrieved === 1,
+      'report projects one correlated self-evolve opportunity -> accepted -> persisted -> retrieved funnel');
+    const lifecycleSerialized = fs.readFileSync(file, 'utf8');
+    check(!lifecycleSerialized.includes(lessonId) && !lifecycleSerialized.includes(session),
+      'lesson telemetry hashes candidate/session identities instead of retaining raw IDs');
+
     const forbidden = telemetry.emitTelemetry({
       event: 'skill.invoke',
       host: 'claude',
@@ -173,7 +199,11 @@ async function main() {
     }
 
     const schema = JSON.parse(fs.readFileSync(path.join(ROOT, 'telemetry/schemas/event.schema.json'), 'utf8'));
-    check(schema.properties?.timing?.properties?.activeWindowMs && schema.properties?.event?.enum?.includes('tool.observed'), 'versioned telemetry schema preserves separate timing vocabulary');
+    check(schema.properties?.timing?.properties?.activeWindowMs &&
+      schema.properties?.event?.enum?.includes('tool.observed') &&
+      schema.properties?.event?.enum?.includes('learning_opportunity') &&
+      schema.properties?.event?.enum?.includes('lesson_retrieved'),
+      'versioned telemetry schema preserves timing plus self-evolve lifecycle vocabulary');
 
   } finally {
     if (priorHome === undefined) delete process.env.HARNESS_STATE_HOME;

package/docs/architecture.md

@@ -73,6 +73,23 @@ For selected Fable topologies on Claude:
 
 Other topologies use their own applicable mechanisms: loop budgets, regular verification stop-gates, action gates, and task-specific skills. Mechanism coverage is not assumed identical across hosts.
 
+### Scoped runtime advisories and capabilities
+
+Two kernel mechanisms adjust plans without changing the mandatory-workflow contract:
+
+- **Ensemble policy (`harness-everything/scripts/ensemble-policy.js`):** an advisory plan annotation, not a separate topology. It is selected only when uncertainty is high (or stakes are high) **and** the task asks for comparable outputs or preserves explicit disagreement **and** the selected strategy is already `fable-*`. Creative generation, mechanical bulk work, an explicit user prohibition, unavailable subagents, or a blocked base plan force exclusion. When selected, the plan caps at 3 candidates with `preserve-disagreement` synthesis, an independent verifier, and `parallel-self-consistency` pattern invariants. Covered by deterministic mechanism tests; no live-host effectiveness claim follows from the annotation alone.
+- **Single-use memory capability (`kernel-router.js#issueMemoryCapability`):** when the selected plan permits memory writes, the router issues one capability token bound to `sessionId`/`workflowId` with a stored SHA-256 hash (`memoryAuthorization`, coordinator-only writer role, `usedAt` tracking). Plans with `memory.write === 'none'` receive no capability. This binds a memory write to the workflow that authorized it; it is not a general credential and proves nothing about a live host honoring the binding.
+
+### PreToolUse guard trio and denied-mutation probes
+
+On the Claude hook path, three narrowly scoped `PreToolUse` guards sit alongside the workflow/action gates:
+
+- `boundary-guard.js` (Grep/Glob/Read): hard-blocks whole-file reads over 512KB without `offset`/`limit` and searches inside known noise directories (`node_modules`, `.git`, build output, etc.). Fails open on parse/lookup errors.
+- `depth-guard.js` (Write): blocks overwriting an existing file that was never Read earlier in the session transcript. New files are unaffected. Fails open on parse/lookup errors.
+- `context-compact.js`: estimates working-tree context pressure from `git status`/`git diff --numstat` so later stages can compact or halt before lost-in-the-middle degradation.
+
+Shell mutation accounting is per-tool-call: `workflow-isolation.js` fingerprints observed effects per tool-use identity, `state-persist.js` settles probes in a single ordered handler, and `workflow-mutation-denied.js` discards probes for denied shell executions so a denial never counts as an observed mutation. See [runtime transitions and limitations](workflow-runtime.md). These are mechanism-tested behaviors on the packaged hook surface, not proof that a live session loaded or fired them.
+
 ## Integration Touchpoints
 
 Harness aligns to each host's actual lifecycle/tool APIs. Shared skill text defines a contract; only supported host mechanisms can mechanically block or observe particular transitions.

package/docs/audit.md

@@ -2,17 +2,58 @@
 
 Maintainer-facing audit record. If you just want to know whether Harness works and how to verify it yourself, start at [VERIFICATION.md](../VERIFICATION.md) instead — this file records *how the scores below were obtained* and what changed between audit cycles.
 
-> **Historical snapshot boundary:** the scorecard below is the 2026-09-01 audit and is intentionally preserved as evidence of what was measured on that date. Platform capabilities have changed since then (including the OpenAI/Codex local plugin work and the OpenCode plugin implementation). Do not treat the 2026-09-01 platform rows as current-state documentation; use [platform-capabilities.md](platform-capabilities.md) for the current matrix.
+> **Historical snapshot boundary:** the scorecards below are dated audits and are intentionally preserved as evidence of what was measured on each date. Platform capabilities have changed since the 2026-09-01 snapshot (including the OpenAI/Codex local plugin work and the OpenCode plugin implementation). Do not treat any dated platform row as current-state documentation; use [platform-capabilities.md](platform-capabilities.md) for the current matrix.
 
-**Last self-audited: 2026-09-01**, by running the actual test suite and the VERIFICATION.md recipes on Windows 11 — not by reading the code and assuming it works.
+**Last self-audited: 2026-09-18**, by running the deterministic test suite and gates on macOS (Node.js 24.14.1) — not by reading the code and assuming it works. The 2026-09-01 Windows 11 snapshot is preserved below. Live-host and behavioral evidence layers were not re-run in this cycle; retained artifacts are referenced, not re-measured.
 
-## The 2026-07-23 mis-measurement incident
+## The 2026-09-18 audit cycle
+
+Measured on `docs/sync-skills-and-mechanisms` at `45f2123` (docs-only delta over v0.11.6): 26/26 on-disk canonical skills, 26/26 routing-eval directories (`evals/` also holds `evaluation-reports.md`), and the following gate results:
+
+| Gate | Result on 2026-09-18 |
+|---|---|
+| `npm test` (self-regression, 43 passing checks) | Green except one pre-existing failure: `mechanism-30-opencode-plugin-loadability`, reproduced on the clean tree and caused by leftover `.worktrees/docs-skill-catalog` fixtures asserting `.mjs` destinations — not by product code |
+| `npm run test:mutations` | Passed: 8 production mutations rejected by focused tests |
+| `npm run test:consistency` (incl. doc-capability + repo-contract) | Passed |
+| `npm run test:references` | Passed: 66 skill path references resolve across 26 skills |
+| `npm run test:collision` | Passed: no description collisions at 0.75 threshold |
+| `npm run test:routing:skills` | Passed: 34 positive cases across 26 direct skills; 4 nested skills classified |
+| `npm run test:routing:invariants` | Passed: 275 checks, 0 failures (incl. workflow execution enforcement) |
+| `node ci/disclosure-check.js` | Passed: 26 skills, 26 workflow docs |
+| `npm run test:plugin:openai` / `test:plugin:submission` / `test:platform:compatibility` / `test:release` | All passed; release catalog green for v0.11.6 at 26/26 |
+| `waza tokens check` | All 26 canonical skills within the 500-token limit; the single exceedance is the intentional `eval-framework/fixtures/over-budget-skill` negative control (855 tokens, exists to exercise the failure path) |
+
+Since the 2026-09-01 snapshot, the product gained the mandatory-workflow contract (#142), runtime budget enforcement (#143), structured action gate (#144), memory governance (#145), self-evolve closed loop (#146), telemetry core (#147), contract-integrity phase 1 (#148), workflow controller recovery and isolation hardening (#150/#152/#154/#156/#158), observed-mutation accounting (#160), the Codex local plugin plus Claude certification boundary (#123), OpenCode `.js` loadability guard and partial live-host evidence (#128/#129), and the paired-benchmark contract (#130) — all covered by deterministic mechanism tests. The docs lag this cycle closed: stale `docs/workflows` rewrites, the README index gaps, and the previously undocumented ensemble/memory/guard/probe mechanisms are synced in the same change as this audit entry.
+
+## Five Core Verification Criteria — 2026-09-18 re-measurement
+
+| Criterion | Score | Verified basis |
+|---|---|---|
+| **Skill Description Completeness** | 10/10 | 26/26 skill directories carry complete frontmatter and the required trigger sections, verified by the consistency gate in this cycle. Internal hooks remain intentionally non-routable. |
+| **Routing Accuracy** | 9/10 | 34/34 positive prompts across all 26 skills plus 275/275 invariant-routing checks in this cycle. Waza generalization (ambiguous/metaphorical prompts) and live model sessions remain unmeasured. |
+| **Test Coverage of All Skills** | 9.5/10 | Self-regression now spans syntax, CLI, routing matrix, positive route coverage, invariant routing, references, behavioral-case structure, Fable contract, mutations, and 40+ mechanism suites. Waza full-matrix verify and live sessions remain separate on-demand evidence; `mechanism-30` is red only where the stale `.worktrees` leftover exists. |
+| **Configuration Balance** | 9/10 | Hard `exit(2)` blocking hooks on Claude Code, mechanism-tested local Codex plugin package, and partial OpenCode live-host evidence (project `.js` scope, 1.18.31 macOS) — all centralized in `docs/platform-capabilities.md`. Live parity beyond the retained artifacts is still unclaimed. |
+| **Workflow Conformance** | 9/10 | 26/26 skills have matching workflow documents (two stale ones rewritten in this cycle), the selected-workflow contract with escape/budget/stop-gate semantics is mechanism-tested, and disclosure passes. Runtime tool-call sequence conformance remains host-dependent and is not claimed. |
+
+## Overall Scorecard — 2026-09-18
+
+| Category | Score | Notes |
+|---|---|---|
+| **Architecture** | 9/10 | Per-session state isolation, worktree-gated Tier 3 mutation, per-tool mutation probes settled in one ordered handler, and single-use memory capabilities — all mechanism-tested in this cycle. |
+| **Test Coverage** | 9.5/10 | 43 passing self-regression checks, 8/8 mutations rejected, 66/66 references resolve. Live model evaluation remains on-demand and is not represented by a local simulation. |
+| **README Completeness** | 9.5/10 | Catalog counts, layer labels, route coverage, and the 26-skill tree match after this cycle's index fix (`contract-integrity`/`telemetry`/`eval-framework` rows added). |
+| **Maintainability** | 9/10 | ~600 commits across 20+ PRs since 09-01 landed without breaking the consistency/release/disclosure gates; new non-skill directories are documented as non-skills rather than left ambiguous. |
+| **Skills Design** | 9.5/10 | All 26 skills keep the Skill Contract format, `USE FOR`/`DO NOT USE FOR` sections, and the 500-token limit (verified by waza in this cycle); internal hooks remain intentionally non-routable. |
+| **Agent Compatibility** | 9/10 | Claude hard-mechanism support measured, Codex local plugin mechanism-tested, OpenCode partial live evidence retained — see the current platform matrix, not this row, for status. |
+| **Beginner Friendliness** | 7.5/10 | Unchanged since 09-01: Tier Routing / Rule of 3 / session-scoped state remain load-bearing concepts. The two rewritten workflow docs reduce stale-doc confusion but add no onboarding track. Not addressed in this audit round. |
+
+## The 2026-07-23 mis-measurement incident (preserved)
 
 Seven independent AI-model audits (Gemini 3.1 Pro, Gemini 3.5 Flash, GPT/Copilot on Mistral Medium/Small, and others) ran the same week and disagreed sharply on whether core hooks even functioned. Three of them tested `rule-of-3.js`, `boundary-guard.js`, and `state-persist.js` by piping JSON through `echo '...' | node script.js` in Windows Git Bash, which mangles stdin/TTY state and produced false "broken" verdicts. Re-running the identical payloads through Node's own `child_process` stdin API (the technique VERIFICATION.md's recipes now use) showed every one of those mechanisms working exactly as documented — the scores below reflect that corrected, verified state, not the average of the seven reports.
 
 This incident is why VERIFICATION.md's recipes were rewritten to be Windows-safe (`node -e` stdin instead of a shell `echo` pipe), and why the §2 mechanism checks were automated as `ci/mechanism-test.js` (`npm run test:mechanism`) — copy-paste recipes that can be mis-executed are not a reliable verification substrate.
 
-## Five Core Verification Criteria (per VERIFICATION.md §5a)
+## Five Core Verification Criteria — 2026-09-01 snapshot (per VERIFICATION.md §5a)
 
 | Criterion | Score | Verified basis |
 |---|---|---|
@@ -22,7 +63,7 @@ This incident is why VERIFICATION.md's recipes were rewritten to be Windows-safe
 | **Configuration Balance** | 8.5/10 | **Historical 2026-09-01 result:** hard `exit(2)` blocking hooks were measured on Claude Code and the other then-installed platform paths were evaluated as advisory. This row predates the later OpenAI/Codex local plugin and OpenCode plugin work; see `docs/platform-capabilities.md` for current status. |
 | **Workflow Conformance** | 8.5/10 | Every skill in the snapshot had a matching workflow document, and `ci/skill-routing-check.js` executed every positive route case against the real router. Runtime tool-call sequence conformance remained host-dependent and was not claimed. |
 
-## Overall Scorecard
+## Overall Scorecard — 2026-09-01 snapshot
 
 | Category | Score | Notes |
 |---|---|---|
@@ -36,6 +77,12 @@ This incident is why VERIFICATION.md's recipes were rewritten to be Windows-safe
 
 ## Change log by audit cycle
 
+### 2026-09-18
+- Re-measured the deterministic suite and gates on macOS (Node.js 24.14.1): 43 passing self-regression checks, 8/8 mutations rejected, 66/66 references resolve, 34/34 positive routes, 275/275 invariant checks, disclosure 26/26, release catalog green for v0.11.6. Sole red is the pre-existing `mechanism-30` failure from leftover `.worktrees/docs-skill-catalog` fixtures, reproduced on the clean tree.
+- Closed the docs lag accumulated since 09-01 in the same change: rewrote the stale `docs/workflows/harness-everything.md` and `install-cognitive-os.md`, added the missing README index rows (`contract-integrity`/`telemetry`/`eval-framework`), and documented the ensemble policy, single-use memory capability, guard trio, and mutation-probe lifecycle in `docs/architecture.md` / `docs/workflow-runtime.md`.
+- Product changes since 09-01 now covered by mechanism tests: mandatory-workflow contract, budget enforcement, structured action gate, memory governance, self-evolve closed loop, telemetry core, contract-integrity phase 1, controller recovery/isolation hardening, observed-mutation accounting, Codex local plugin, OpenCode partial live evidence, paired-benchmark contract. Live-host and behavioral layers were not re-run; retained artifacts stand.
+- Beginner Friendliness stays 7.5/10: still no onboarding track. Candidate for the next cycle.
+
 ### 2026-09-01
 - Fable v3 integration exposed explicit Haiku, Sonnet, and Opus entrypoints, with deterministic model selection and visible inline fallback or blocked escalation in `fable-mode/model-matrix.json` and `fable-mode/scripts/model-selector.js`.
 - The workflow used native host TODO tracking or Markdown checklists. The older shared TODO CLI/state-machine references below are retained only as historical audit evidence; no current runtime, test, or active workflow depends on them.

package/docs/release-evidence.md

@@ -9,6 +9,9 @@ The following evidence was collected on 2026-09-07 before the issue #20 integrat
 | Version | Registry observation | GitHub release | Workflow run | Gate and publish result |
 | --- | --- | --- | --- | --- |
 | 0.3.6 | `npm view harness-everything version dist-tags --json`: version and latest are `0.3.6` | `v0.3.6`, published 2026-09-01T03:50:44Z | [33466676632](https://github.com/dyphn1/Harness-everything/actions/runs/33466676632), commit `5aa74119d08ff241a7d6fe8f163a6a0d40c3c932` | `gate=success`, `publish=success` |
+| 0.11.6 | `npm view harness-everything version dist-tags --json` (collected 2026-09-18): version and latest are `0.11.6` | `v0.11.6`, published 2026-09-18T12:51:58Z | [35346673284](https://github.com/dyphn1/Harness-everything/actions/runs/35346673284), commit `23d87db8230dcb524651dc67e932f54aa6f5c737` | `gate=success` (12/12 jobs incl. skill-quality, runtime-floor, self-regression x3 OS, consistency x3 OS, installer-e2e x3 OS, release-semantics), `publish=success` (job `release`) |
+
+Intermediate versions between 0.3.6 and 0.11.6 were published via the same tag-driven workflow but were not individually ledgered here; the rows above are the two deliberately collected observations. A registry/GitHub listing alone is still not a completed row — each field must be a command output or inspectable URL.
 
 The source capture for this row is the local review artifact `.git/issue-review-20260907/release-evidence.md`. That review artifact is not expected to be present in every checkout; it is historical evidence, not a release artifact shipped in the npm package.
 

package/docs/workflow-runtime.md

@@ -63,6 +63,19 @@ have effects a hook cannot infer. OS/host sandboxing is needed to contain them.
 Agent-writable state is also not tamper-proof. These mechanisms prevent tested
 bypasses; they do not establish durable containment against a malicious agent.
 
+## Mutation probes
+
+Shell-effect accounting is keyed per tool call, not per command text. The gate
+registers a pending probe per shell tool-use identity (`workflow-isolation.js`),
+`state-persist.js` settles probes in a single ordered handler, and
+`workflow-mutation-denied.js` discards the probe when that shell execution is
+denied — a denial is never recorded as an observed mutation. Staging-insensitive
+fingerprinting keeps the comparison on visible content, so metadata-only Git
+operations do not register as workspace effects. These lifecycle semantics are
+covered by deterministic workflow mechanism tests (`ci/mechanism-2ah-*`); live
+host loading and behavioral improvement still require separately retained host
+traces and paired evaluations.
+
 ## Escape, replan, and completion
 
 Escape names one stage in the correlated run and records the uncovered scope,

package/docs/workflows/environment-detection.md

@@ -1,63 +1,73 @@
 # Workflow: Environment Detection
 
-> Active shell, operating system, and toolset environment detection, providing safety guardrails and running preflight syntactic verification.
+> Detect OS, shell variant, and available dev tools at session start so commands use the right path, variable, and CLI syntax and avoid repeated execution errors.
 
----
+Source of truth: `environment-detection/SKILL.md`.
 
 ## 1. Skill Behavior Workflow
 
-This section visualizes how the `environment-detection` skill executes internally, detailing the sequence of operations, state transitions, and evaluation steps.
-
 ```mermaid
 graph TD
-  Start([Session Start / Discover Phase]) --> CheckNode{Node.js Executable?}
-  CheckNode -->|Yes| RunPreflight["Run scripts/preflight.js"]
-  CheckNode -->|No / Fails| Heuristic["Inspect <environment_info> & Probe Shell via echo/env"]
-  
-  RunPreflight --> ParseOutput["Parse OS, Shell, Path Separators & CLI Runtimes"]
-  Heuristic --> ParseOutput
-  
-  ParseOutput --> SelfHeal["Run self-heal.js if Node available"]
-  SelfHeal --> AlignSyntax["Adopt Path Slash (/ vs \\) & Env Var Syntax ($VAR vs %VAR%)"]
-  AlignSyntax --> End([Environment Context Established])
+  SessionStart([Session start or complex terminal sequence]) --> Preflight[Run preflight.js from skill dir]
+  Preflight --> PreflightOk{Preflight succeeded?}
+  PreflightOk -->|yes| ParseOut[Parse OS shell PATH and CLIs]
+  PreflightOk -->|no| FallbackProbe[Inspect environment_info and probe shell]
+  FallbackProbe --> ParseOut
+  ParseOut --> SelfHealAudit[Audit harness touchpoints with self-heal.js]
+  SelfHealAudit --> AdoptSyntax[Adopt shell-specific syntax]
+  AdoptSyntax --> DoneCtx([Session context aligned])
 ```
 
----
+```mermaid
+graph TD
+  Adopted[Adopted syntax context] --> GitBash[Git Bash: forward slash and dollar-VAR with Unix cmds]
+  Adopted --> PowerShell[PowerShell: env-prefix vars with cmdlets]
+  Adopted --> CmdShell[CMD: backslash and percent-VAR with dir del copy]
+  GitBash --> GuardCwd[Stay inside process cwd]
+  PowerShell --> GuardCwd
+  CmdShell --> GuardCwd
+  GuardCwd --> FailCount{Same command failed 3 times?}
+  FailCount -->|yes| ZoomEsc[Trigger zoom-out]
+  FailCount -->|no| ContinueRun[Continue with aligned syntax]
+```
 
 ## 2. Triggering and Routing Path
 
-This diagram illustrates how the `environment-detection` skill is triggered through user requests or developer actions, and how it integrates or chains together with other companion skills in the Harness OS ecosystem to form unified workflows.
-
 ```mermaid
 graph LR
-  Router["harness-everything / tier-router.js"] -->|Pre-flight command execution| Env["environment-detection / SKILL.md"]
-  Env -->|Guards runner execution commands in| TDD["tdd / SKILL.md"]
-  Env -->|Guards script installations in| InstallOS["install-cognitive-os / SKILL.md"]
-  Env -->|Guards PR quality checks in| VerLoop["verification-loop / SKILL.md"]
+  StartTrigger[Session start request] --> EnvDetect[environment-detection SKILL]
+  ComplexSeq[Complex terminal sequence] --> EnvDetect
+  EnvDetect --> AlignedRun[Aligned command execution]
+  AlignedRun --> RepeatedFail{Three failures on same command?}
+  RepeatedFail -->|yes| ZoomOut[zoom-out]
+  RepeatedFail -->|no| AlignedRun
 ```
 
----
+## 3. Real-World Use Case
 
-## 3. Real-World Use Case Flowchart
+A session starts on Windows with PowerShell as the active shell. The agent needs to list files and check Node availability before running tests.
 
-Here we model concrete real-world scenarios and use cases of the `environment-detection` skill, illustrating standard success paths, error handling, or recovery loops.
+1. Run `node "<skill-dir>/scripts/preflight.js"` to detect Windows + PowerShell + available CLIs.
+2. Adopt PowerShell syntax for paths and env vars instead of Git Bash assumptions.
+3. If `preflight.js` cannot run, inspect `<environment_info>` and probe with minimal echo/env commands, then adopt syntax.
+4. Stay inside `process.cwd()`; ignore other workspace, history, or temp paths shown by the IDE.
+5. If the same aligned command still fails three times, stop retrying the syntax and trigger `zoom-out`.
 
 ```mermaid
 graph TD
-  Start["Agent wants to run: 'rm -rf build && mkdir build' on Windows Powershell"] --> Trigger["Environment detection pre-flight check"]
-  Trigger --> Detect["Identifies OS: Windows, Shell: PowerShell"]
-  Detect --> AnalyzeSyntax["Identifies that 'rm -rf' will fail or behave unexpectedly in PowerShell"]
-  AnalyzeSyntax --> Rewrite["Rewrites command to PowerShell equivalent or executes using native node commands"]
-  Rewrite --> Run["Executes safely with exit code 0"]
-  Run --> Done([Syntax error and execution crash avoided])
+  AgentGoal[Need to list files and check Node on Windows] --> DetectEnv[Run session-start detection]
+  DetectEnv --> FoundShell[Detected PowerShell on Windows]
+  FoundShell --> UseCmd[Use PowerShell syntax for listing and env lookup]
+  UseCmd --> CmdResult{Command works?}
+  CmdResult -->|yes| ProceedTask[Proceed with task]
+  CmdResult -->|no after 3 tries| ZoomStep[Trigger zoom-out]
 ```
 
----
-
 ## 4. Verification Check
 
-To ensure that the `environment-detection` skill is operating in strict compliance with Harness OS design laws, verify the following:
-
-- [ ] **Physical Boundary Verification**: The skill boundaries are respected and do not leak context.
-- [ ] **State Checkpoint Verification**: The active state is established, validated, and recorded at the beginning and end of each execution branch.
-- [ ] **Cognitive Alignment**: The skill conforms to the **Think > Try > Summarize > Record** cognitive loop.
+- [ ] Detection ran at session start via `environment-detection/scripts/preflight.js`, with `<environment_info>` inspection and probing used only as fallback
+- [ ] Adopted syntax matches detected shell: Git Bash uses `/`, `$VAR`, Unix cmds without `dir`/`del`; PowerShell uses `$env:VAR` and cmdlets; CMD uses `\`, `%VAR%`, `dir`/`del`/`copy` without Unix cmds
+- [ ] All commands stayed inside `process.cwd()`; no commands ran outside the current project root
+- [ ] No toolchain installation was attempted; scope stayed to detection, alignment, and touchpoint repair
+- [ ] After three failures of the same command, execution stopped blind retry and triggered `zoom-out`
+- [ ] Shell detail followed `environment-detection/references/shell-syntax-rules.md` where needed