harness-everything 0.11.7 → 0.12.0

package/ci/mechanism-2ah-workflow-lifecycle.test.js

@@ -17,6 +17,7 @@ const env = { ...process.env, HARNESS_STATE_HOME: path.join(temp, 'state'), HARN
 process.env.HARNESS_STATE_HOME = env.HARNESS_STATE_HOME;
 const state = require(path.join(runtimeRoot, 'hooks/scripts/lib/harness-state'));
 const workflowRuntime = require(path.join(runtimeRoot, 'hooks/scripts/lib/workflow-runtime'));
+const workflowIsolation = require(path.join(runtimeRoot, 'hooks/scripts/lib/workflow-isolation'));
 const sessionId = 'workflow-lifecycle';
 const payload = { session_id: sessionId, cwd: repo };
 const sessionDir = state.getSessionDir(repo, sessionId);
@@ -85,6 +86,28 @@ const probeFiles = () => {
 };
 const stop = extra => node('hooks/scripts/workflow-stop-gate.js', { ...payload, ...extra });
 const control = (...args) => node('hooks/scripts/workflow-disposition.js', null, [args[0], '--session-id', sessionId, ...args.slice(1)]);
+function fixtureSession(fixtureSessionId) {
+  const fixturePayload = { session_id: fixtureSessionId, cwd: repo };
+  const fixtureSessionDir = state.getSessionDir(repo, fixtureSessionId);
+  const fixtureFile = path.join(fixtureSessionDir, 'workflow-run.json');
+  return {
+    payload: fixturePayload,
+    file: fixtureFile,
+    sessionDir: fixtureSessionDir,
+    route: prompt => node('harness-everything/scripts/kernel-router.js', { ...fixturePayload, prompt }),
+    gate: (tool, input, extra = {}) => node('hooks/scripts/workflow-gate.js', { ...fixturePayload, ...extra, tool_name: tool, tool_input: input }),
+    persist: (tool, input, response = {}, extra = {}) => node('hooks/scripts/state-persist.js', {
+      ...fixturePayload,
+      ...extra,
+      hook_event_name: 'PostToolUse',
+      tool_name: tool,
+      tool_input: input,
+      tool_response: response,
+    }),
+    stop: extra => node('hooks/scripts/workflow-stop-gate.js', { ...fixturePayload, ...extra }),
+    control: (...args) => node('hooks/scripts/workflow-disposition.js', null, [args[0], '--session-id', fixtureSessionId, ...args.slice(1)]),
+  };
+}
 const stages = [
   { stageId: 'build', goal: 'fix', agent: 'fable-worker', task: 'fix bounded module', dependsOn: [], writeSet: ['src'], checkCommand: 'node test-build.js', passCondition: 'exit 0' },
   { stageId: 'optional', goal: 'external scope', agent: 'fable-worker', task: 'external task', dependsOn: [], writeSet: [], checkCommand: 'node external.js', passCondition: 'exit 0' },
@@ -92,6 +115,78 @@ const stages = [
 ];
 
 try {
+  // #162: Tier-2 shell accounting must degrade conservatively when a workspace
+  // is not a Git repository. Lack of a Git fingerprint is not an isolation
+  // violation for a non-major workflow.
+  const nonGit = fixtureSession('workflow-non-git');
+  check(nonGit.route('Fix this checkout bug with a regression test').status === 0 &&
+    read(nonGit.file).strategy === 'iterative-single',
+    '#162 non-git fixture routes to Tier 2 iterative workflow');
+  check(nonGit.control('start').status === 0 && read(nonGit.file).state === 'running',
+    '#162 non-git Tier 2 workflow starts normally');
+  let nonGitIterations = read(nonGit.file).budget?.counters?.iterations || 0;
+  for (const [index, command] of ['npm --version', 'node -e "process.exit(0)"', 'cd .', 'git init -q'].entries()) {
+    const toolUseId = 'toolu_non_git_pre_' + index;
+    const admitted = nonGit.gate('Bash', { command }, { tool_use_id: toolUseId });
+    check(admitted.status === 0, '#162 non-git Tier 2 admits untrusted shell: ' + command);
+    const afterGate = read(nonGit.file);
+    check(afterGate.budget.counters.iterations === ++nonGitIterations &&
+      afterGate.lastMutationAt > 0 &&
+      afterGate.budget.events.at(-1)?.evidence === 'shell:unobservable-workspace',
+      '#162 unobservable non-git shell is conservatively counted once: ' + command);
+    check(nonGit.persist('Bash', { command }, { stdout: 'fixture success' }, { tool_use_id: toolUseId }).status === 0,
+      '#162 non-git shell PostToolUse stays fail-open without a probe: ' + command);
+  }
+
+  // A probe may have been created while Git was observable and become
+  // unobservable before PostToolUse (for example .git disappears). Tier 2
+  // must settle it conservatively instead of blocking the workflow.
+  const lostObservationId = 'toolu_non_git_post_fallback';
+  const lostObservationPayload = {
+    ...nonGit.payload,
+    tool_name: 'Bash',
+    tool_use_id: lostObservationId,
+    tool_input: { command: 'node lost-observation.js' },
+  };
+  const lostObservationContext = workflowRuntime.loadWorkflow(lostObservationPayload);
+  const lostObservationKey = workflowIsolation.shellProbeKey(lostObservationPayload, repo);
+  workflowRuntime.registerMutationProbe(lostObservationContext, lostObservationKey, 'f'.repeat(64), true);
+  const beforeLostObservation = read(nonGit.file);
+  check(nonGit.persist('Bash', { command: 'node lost-observation.js' }, { stdout: 'fixture success' },
+    { tool_use_id: lostObservationId }).status === 0,
+    '#162 Tier 2 PostToolUse degrades when workspace observation becomes unavailable');
+  const afterLostObservation = read(nonGit.file);
+  check(afterLostObservation.state === 'running' &&
+    afterLostObservation.budget.counters.iterations === beforeLostObservation.budget.counters.iterations + 1 &&
+    afterLostObservation.lastMutationAt >= (beforeLostObservation.lastMutationAt || 0),
+    '#162 lost post-observation is settled as one conservative mutation without blocking');
+
+  const nonGitTarget = path.join(repo, 'non-git-edit.txt');
+  check(nonGit.gate('Write', { file_path: nonGitTarget }).status === 0,
+    '#162 direct edit remains available in non-git Tier 2');
+  fs.writeFileSync(nonGitTarget, 'changed\n');
+  check(nonGit.persist('Write', { file_path: nonGitTarget }).status === 0,
+    '#162 direct non-git edit persists mutation milestone');
+  const verifyId = 'toolu_non_git_verify';
+  check(nonGit.gate('Bash', { command: 'node run-test.js' }, { tool_use_id: verifyId }).status === 0,
+    '#162 verification shell is admitted in non-git Tier 2');
+  check(nonGit.persist('Bash', { command: 'node run-test.js' }, { stdout: 'tests passed' },
+    { tool_use_id: verifyId }).status === 0,
+    '#162 non-git verification result is persisted');
+  check(nonGit.stop().status === 0 && read(nonGit.file).state === 'satisfied',
+    '#162 edit then verification can satisfy Stop in non-git Tier 2');
+
+  const nonGitMajor = fixtureSession('workflow-non-git-major');
+  check(nonGitMajor.route('Refactor the entire authentication architecture across all services without fable').status === 0 &&
+    read(nonGitMajor.file).tier === 'tier3',
+    '#162 non-git major fixture routes to Tier 3');
+  check(nonGitMajor.control('start').status === 0 && read(nonGitMajor.file).state === 'running',
+    '#162 non-Fable Tier 3 controller can enter running state before mutation');
+  const majorBlocked = nonGitMajor.gate('Bash', { command: 'node mutate.js' }, { tool_use_id: 'toolu_non_git_major' });
+  check(majorBlocked.status === 2 && /Git worktree isolation/i.test(majorBlocked.stderr),
+    '#162 non-git Tier 3 remains fail-closed with an isolation-specific error');
+
+  fs.unlinkSync(nonGitTarget);
   git(['init']); fs.writeFileSync(path.join(repo, 'README.md'), 'fixture\n'); git(['add', '.']);
   git(['-c', 'user.name=Harness Test', '-c', 'user.email=harness@example.invalid', 'commit', '-m', 'fixture']);
   git(['worktree', 'add', linked, '-b', 'isolated']);
@@ -225,6 +320,48 @@ try {
     promotedTier3.mutationIsolation?.required === true && !promotedTier3.pendingPlan, 'pending Tier 3 isolation becomes active atomically on start');
   check(workflowRuntime.isMajorWorkflow(promotedTier3), 'major-workflow classification flips only after explicit activation');
   check(gate('Write', { file_path: path.join(repo, 'premature-primary.js') }, repo).status === 2, 'activated Tier 3 plan still blocks primary-tree mutation');
+
+  // #163: a queued Tier-3 plan can intentionally remain single-agent when
+  // Fable is prohibited. Explicit start must still promote the whole plan,
+  // including isolation and budget metadata, before any mutation is admitted.
+  fs.unlinkSync(file);
+  check(route('Fix this checkout bug with a regression test').status === 0 && read(file).strategy === 'iterative-single',
+    '#163 fixture starts from a Tier 2 iterative workflow');
+  check(control('start').status === 0 && read(file).state === 'running',
+    '#163 fixture activates Tier 2 before a stronger route arrives');
+  check(route('Refactor the entire authentication architecture across all services and migrate the database schema without fable').status === 0,
+    '#163 stronger Tier 3 route without Fable is retained for explicit replan');
+  const queuedNonFableTier3 = read(file);
+  check(queuedNonFableTier3.state === 'blocked' &&
+    queuedNonFableTier3.pendingPlan?.tier === 'tier3' &&
+    queuedNonFableTier3.pendingPlan?.strategy === 'iterative-single' &&
+    queuedNonFableTier3.pendingPlan?.mutationIsolation?.required === true,
+    '#163 queued Tier 3 plan remains non-Fable but still requires isolation');
+  write(file, {
+    ...queuedNonFableTier3,
+    budget: {
+      ...queuedNonFableTier3.budget,
+      limits: { ...queuedNonFableTier3.budget.limits, maxIterations: 1 },
+    },
+  });
+  check(control('start').status === 0, '#163 explicit start activates queued non-Fable Tier 3 plan');
+  const promotedNonFableTier3 = read(file);
+  check(promotedNonFableTier3.workflowPlan?.tier === 'tier3' &&
+    promotedNonFableTier3.tier === 'tier3' &&
+    promotedNonFableTier3.strategy === 'iterative-single' &&
+    promotedNonFableTier3.mutationIsolation?.required === true &&
+    !promotedNonFableTier3.pendingPlan,
+    '#163 non-Fable Tier 3 plan replaces all authoritative active-plan fields');
+  check(promotedNonFableTier3.budget?.limits?.maxIterations === promotedNonFableTier3.workflowPlan?.limits?.maxIterations &&
+    promotedNonFableTier3.budget?.limits?.maxIterations !== 1,
+    '#163 plan activation re-derives budget limits from the promoted plan');
+  check(workflowRuntime.isMajorWorkflow(promotedNonFableTier3),
+    '#163 non-Fable Tier 3 promotion enables major-workflow isolation');
+  check(gate('Write', { file_path: path.join(repo, 'non-fable-primary.js') }, repo).status === 2,
+    '#163 promoted non-Fable Tier 3 blocks primary-tree mutation');
+  check(gate('Write', { file_path: path.join(linked, 'non-fable-linked.js') }, linked).status === 0,
+    '#163 promoted non-Fable Tier 3 admits linked-worktree mutation');
+
   fs.unlinkSync(file);
   check(route('Fix this checkout bug with a regression test').status === 0 && read(file).strategy === 'iterative-single', 'fresh bounded fix returns to Tier 2 iterative lifecycle');
   let tier2 = read(file);

package/ci/mechanism-32-paired-benchmark.test.js

@@ -6,8 +6,11 @@ const crypto = require('crypto');
 const helper = require('./test-helper');
 const {
   mcnemarExactP,
+  pairContract,
   prepareArmWorkspace,
+  retrieveLesson,
   summarizePairs,
+  validateLessonCase,
   validatePairRecord,
   validateRunConfig,
 } = require('../behavioral-evals/paired-benchmark');
@@ -142,6 +145,142 @@ try {
   fs.rmSync(pluginBaseline.ws, { recursive: true, force: true });
   fs.rmSync(pluginTreatment.ws, { recursive: true, force: true });
 
+  const lessonCase = {
+    id: 'lesson-retrieval-shape',
+    discipline: 'verify-before-claim',
+    loaded_skills: ['verify-before-claim'],
+    prompt: 'npm test is failing for higher retry attempts. Fix it and verify.',
+    max_turns: 8,
+    fixture: { files: [{ path: 'probe.txt', content: 'baseline\n' }] },
+    expectations: [{ type: 'file_contains', path: 'probe.txt', value: 'baseline' }],
+    lesson: {
+      candidate_id: 'lesson-0123456789abcdef01234567',
+      rule: 'When retry delay tests fail at higher attempts, inspect exponential backoff before changing caps and verify with npm test.',
+      scope_task: 'retry delay exponential backoff higher attempts npm test',
+      query_task: 'retry delay exponential backoff higher attempts npm test',
+    },
+  };
+  helper.check(
+    '32. lesson-retrieval case requires a valid accepted-lesson fixture contract',
+    validateLessonCase(lessonCase).length === 0,
+    validateLessonCase(lessonCase).join('; '),
+  );
+  const lessonConfigProblems = validateRunConfig({
+    effect_type: 'lesson-retrieval', engine: 'claude', model: 'test/model',
+    min_effect_pp: 10, repeats: 1,
+  });
+  helper.check(
+    '32. lesson-retrieval is an explicit paired effect type rather than being disguised as skill-text',
+    lessonConfigProblems.length === 0,
+    lessonConfigProblems.join('; '),
+  );
+
+  const lessonBaselinePrepared = prepareArmWorkspace(lessonCase, 'lesson-retrieval', 'baseline', 'claude');
+  const lessonTreatmentPrepared = prepareArmWorkspace(lessonCase, 'lesson-retrieval', 'treatment', 'claude');
+  const lessonStateBaseline = helper.tempDir('.paired-lesson-state-baseline');
+  const lessonStateTreatment = helper.tempDir('.paired-lesson-state-treatment');
+  const baselineLesson = retrieveLesson(
+    lessonCase, lessonBaselinePrepared.memoryStore, lessonStateBaseline, false,
+  );
+  const treatmentLesson = retrieveLesson(
+    lessonCase, lessonTreatmentPrepared.memoryStore, lessonStateTreatment, true,
+  );
+  helper.check(
+    '32. lesson memory store stays outside both agent workspaces',
+    !lessonBaselinePrepared.memoryStore.startsWith(lessonBaselinePrepared.ws + path.sep) &&
+      !lessonTreatmentPrepared.memoryStore.startsWith(lessonTreatmentPrepared.ws + path.sep) &&
+      !fs.existsSync(path.join(lessonBaselinePrepared.ws, 'memories')) &&
+      !fs.existsSync(path.join(lessonTreatmentPrepared.ws, 'memories')),
+    JSON.stringify({ baseline: lessonBaselinePrepared, treatment: lessonTreatmentPrepared }),
+  );
+  helper.check(
+    '32. both arms execute the same scoped retrieval while only treatment receives the context',
+    baselineLesson.evidence.queried === true &&
+      treatmentLesson.evidence.queried === true &&
+      baselineLesson.evidence.exposed === false &&
+      treatmentLesson.evidence.exposed === true &&
+      baselineLesson.evidence.retrieval_set_sha256 === treatmentLesson.evidence.retrieval_set_sha256 &&
+      JSON.stringify(baselineLesson.evidence.candidate_ids) === JSON.stringify(treatmentLesson.evidence.candidate_ids) &&
+      baselineLesson.prompt === lessonCase.prompt &&
+      treatmentLesson.prompt.includes('Harness scoped memory context') &&
+      treatmentLesson.prompt.includes(lessonCase.lesson.candidate_id),
+    JSON.stringify({ baseline: baselineLesson.evidence, treatment: treatmentLesson.evidence }),
+  );
+
+  const lessonContract = pairContract(lessonCase, {
+    effect_type: 'lesson-retrieval',
+    engine: 'claude',
+    model: 'test/model',
+  });
+  const lessonPair = {
+    schema_version: 1,
+    id: lessonCase.id,
+    pair_id: 'lesson-pair',
+    effect_type: 'lesson-retrieval',
+    contract: lessonContract,
+    contract_sha256: hash(lessonContract),
+    arms: {
+      baseline: {
+        ...arm('fail', true),
+        intervention: { skill_text: true, plugin_enforcement: false, lesson_retrieval: false },
+        loaded_skills: ['verify-before-claim'],
+        lesson_retrieval: baselineLesson.evidence,
+      },
+      treatment: {
+        ...arm('pass', true),
+        intervention: { skill_text: true, plugin_enforcement: false, lesson_retrieval: true },
+        loaded_skills: ['verify-before-claim'],
+        lesson_retrieval: treatmentLesson.evidence,
+      },
+    },
+  };
+  helper.check(
+    '32. attributed lesson-retrieval pair is includable only with constant skill text and identical retrieval set',
+    validatePairRecord(lessonPair).included,
+    JSON.stringify(validatePairRecord(lessonPair)),
+  );
+  const lessonSetMismatch = JSON.parse(JSON.stringify(lessonPair));
+  lessonSetMismatch.pair_id = 'lesson-set-mismatch';
+  lessonSetMismatch.arms.treatment.lesson_retrieval.retrieval_set_sha256 = 'different';
+  helper.check(
+    '32. mismatched memory retrieval set excludes the pair instead of counting it as lesson effect',
+    !validatePairRecord(lessonSetMismatch).included &&
+      validatePairRecord(lessonSetMismatch).reason === 'lesson-retrieval-set-mismatch',
+    JSON.stringify(validatePairRecord(lessonSetMismatch)),
+  );
+  const lessonTrustMissing = JSON.parse(JSON.stringify(lessonPair));
+  lessonTrustMissing.pair_id = 'lesson-trust-missing';
+  lessonTrustMissing.arms.treatment.lesson_retrieval.trust_boundary = null;
+  helper.check(
+    '32. treatment without the untrusted-memory boundary is excluded from causal evidence',
+    !validatePairRecord(lessonTrustMissing).included &&
+      validatePairRecord(lessonTrustMissing).reason === 'lesson-trust-boundary-missing',
+    JSON.stringify(validatePairRecord(lessonTrustMissing)),
+  );
+  const lessonContextTamper = JSON.parse(JSON.stringify(lessonPair));
+  lessonContextTamper.pair_id = 'lesson-context-tamper';
+  lessonContextTamper.arms.treatment.lesson_retrieval.context_sha256 = 'tampered';
+  helper.check(
+    '32. changed lesson exposure text invalidates the predeclared pair contract',
+    !validatePairRecord(lessonContextTamper).included &&
+      validatePairRecord(lessonContextTamper).reason === 'lesson-context-hash-mismatch',
+    JSON.stringify(validatePairRecord(lessonContextTamper)),
+  );
+
+  for (const target of [
+    lessonBaselinePrepared.ws, lessonTreatmentPrepared.ws,
+    lessonBaselinePrepared.memoryStore, lessonTreatmentPrepared.memoryStore,
+    lessonStateBaseline, lessonStateTreatment,
+  ]) fs.rmSync(target, { recursive: true, force: true });
+
+  const invalidLesson = JSON.parse(JSON.stringify(lessonCase));
+  invalidLesson.lesson.candidate_id = 'not-a-lesson-id';
+  helper.check(
+    '32. malformed lesson provenance is rejected before any live model call',
+    validateLessonCase(invalidLesson).some(problem => problem.includes('candidate_id')),
+    validateLessonCase(invalidLesson).join('; '),
+  );
+
   const validSkillPair = skillPair('p1', 'fail', 'pass');
   helper.check('32. a correctly isolated skill-text pair is includable', validatePairRecord(validSkillPair).included, JSON.stringify(validatePairRecord(validSkillPair)));
 

package/ci/openai-plugin-package.test.js

@@ -112,6 +112,23 @@ for (const entry of SOURCE_MANIFEST.skills) {
   assertTreesEqual(source, path.join(PLUGIN, 'skills', name), name);
 }
 
+const packagedContractAudit = path.join(PLUGIN, 'contract-integrity', 'scripts', 'audit.js');
+assert.ok(fs.existsSync(packagedContractAudit), 'OpenAI package must include shared contract-integrity runtime outside skills/');
+const packagedAuditSource = fs.readFileSync(packagedContractAudit, 'utf8');
+assert.match(packagedAuditSource, /skills\/tdd\/scripts\/quality-gate/, 'packaged contract audit must resolve #58 evaluator from packaged tdd skill');
+assert.doesNotMatch(packagedAuditSource, /\.\.\/\.\.\/tdd\/scripts\/quality-gate/, 'packaged contract audit must not retain canonical repo-only TDD import');
+const packagedAudit = require(packagedContractAudit);
+assert.strictEqual(typeof packagedAudit.runCli, 'function', 'packaged contract audit runtime must load and export runCli');
+
+const verificationContractWrapper = path.join(PLUGIN, 'skills', 'verification-loop', 'scripts', 'contract-integrity-audit.js');
+assert.ok(fs.existsSync(verificationContractWrapper), 'verification-loop must package its contract audit wrapper');
+const verificationWrapper = require(verificationContractWrapper);
+assert.strictEqual(
+  verificationWrapper.resolveAuditRuntime(),
+  packagedContractAudit,
+  'packaged verification-loop wrapper must resolve the plugin-root contract audit runtime'
+);
+
 const marketplace = JSON.parse(fs.readFileSync(path.join(ROOT, '.agents', 'plugins', 'marketplace.json'), 'utf8'));
 assert.strictEqual(marketplace.name, 'harness-everything', 'marketplace should use the publication name, not a local-only label');
 assert.strictEqual(marketplace.interface?.displayName, 'Harness Everything');

package/ci/self-evolve-loop.test.js

@@ -55,8 +55,10 @@ const {
   createLearningOpportunity,
 } = require(path.join(ROOT, 'hooks/scripts/lib/learning-opportunity.js'));
 const { retrieveMemoryRecords } = require(path.join(ROOT, 'multi-agent-workspace/scripts/index_memory.js'));
+const telemetry = require(path.join(ROOT, 'hooks/scripts/lib/telemetry.js'));
+const { buildReport } = require(path.join(ROOT, 'telemetry/scripts/report.js'));
 
-console.log('=== #141 Self-Evolve Closed Loop Phase 1-3 ===');
+console.log('=== #141 Self-Evolve Closed Loop Phase 1-4 Mechanism ===');
 
 try {
   const tracker = path.join(ROOT, 'hooks/scripts/rule-of-3-tracker.js');
@@ -248,6 +250,15 @@ try {
   }).candidate;
   check(retrievedState.state === 'retrieved' && retrievedState.outcome.evidenceRef === 'retrieval-fixture:REQ-141', 'later retrieval can advance the candidate lifecycle with evidence');
 
+  const validatedState = observeCandidate({
+    workspace,
+    sessionId: verifySession,
+    candidateId: verifyCandidate.candidateId,
+    outcome: 'validated',
+    evidence: 'paired-or-later-outcome-fixture:REQ-141',
+  }).candidate;
+  check(validatedState.state === 'validated', 'later outcome evidence can advance a retrieved lesson to validated');
+
   const duplicate = createLearningOpportunity({
     session_id: ruleSession,
     cwd: workspace,
@@ -287,6 +298,30 @@ try {
   check(sourceHook.includes('createLearningOpportunity') && verifierHook.includes('createLearningOpportunity'), 'negative-control anchors require both runtime emitters');
   check(!sourceHook.includes('persistMemory(') && !verifierHook.includes('persistMemory('), 'runtime recovery hooks cannot directly persist memory');
 
+  const telemetryEvents = telemetry.readEvents(telemetry.telemetryFile(workspace, { cwd: workspace }));
+  const telemetryReport = buildReport(telemetryEvents);
+  const lessonEvents = new Set(telemetryEvents.filter(event => !event.invalid).map(event => event.event));
+  for (const expected of [
+    'learning_opportunity', 'lesson_proposed', 'lesson_screened', 'lesson_evaluated',
+    'lesson_accepted', 'lesson_rejected', 'lesson_inconclusive', 'lesson_persisted',
+    'lesson_retrieved', 'lesson_validated',
+  ]) {
+    check(lessonEvents.has(expected), 'self-evolve lifecycle emits telemetry event: ' + expected);
+  }
+  check(telemetryReport.selfEvolve.funnel.opportunities >= 3 &&
+    telemetryReport.selfEvolve.funnel.accepted >= 1 &&
+    telemetryReport.selfEvolve.funnel.inconclusive >= 1 &&
+    telemetryReport.selfEvolve.funnel.rejected >= 1 &&
+    telemetryReport.selfEvolve.funnel.persisted >= 1 &&
+    telemetryReport.selfEvolve.funnel.retrieved >= 1 &&
+    telemetryReport.selfEvolve.funnel.validated >= 1,
+    'telemetry report exposes opportunity -> disposition -> persisted -> retrieved -> validated funnel');
+  const telemetryText = fs.readFileSync(telemetry.telemetryFile(workspace, { cwd: workspace }), 'utf8');
+  check(!telemetryText.includes('Always verify recovery.test.js') &&
+    !telemetryText.includes('retrieval-fixture:REQ-141') &&
+    !telemetryText.includes('SECRET_OUTPUT_SHOULD_NOT_BE_RETAINED'),
+    'lesson telemetry excludes generalized rules, evidence refs, and raw runtime output');
+
   const lessonSchema = JSON.parse(fs.readFileSync(path.join(ROOT, 'self-evolve/schemas/lesson-candidate.schema.json'), 'utf8'));
   check(lessonSchema.properties?.state?.enum?.includes('inconclusive') && lessonSchema.properties?.trigger?.properties?.type?.enum?.includes('verifier-fail-pass'), 'versioned lesson schema covers lifecycle and trigger vocabulary');
 
@@ -307,5 +342,5 @@ try {
   fs.rmSync(tempRoot, { recursive: true, force: true });
 }
 
-console.log(`\n${failed === 0 ? 'PASS' : 'FAIL'}: #141 self-evolve closed loop phase 1-3 (${failed} failure${failed === 1 ? '' : 's'})`);
+console.log(`\n${failed === 0 ? 'PASS' : 'FAIL'}: #141 self-evolve closed loop phase 1-4 mechanism (${failed} failure${failed === 1 ? '' : 's'})`);
 process.exit(failed === 0 ? 0 : 1);

package/ci/telemetry.test.js

@@ -102,6 +102,32 @@ async function main() {
     check(report.skills[0].invocationCount === 1 && report.skills[0].toolEventCount === 1, 'aggregation retains invocation and attributed-tool counts');
     check(report.semantics.activeWindowMs.includes('not CPU'), 'report documents active-window semantics instead of calling it runtime');
 
+    const lessonId = 'lesson-0123456789abcdef01234567';
+    for (const event of ['learning_opportunity', 'lesson_proposed', 'lesson_screened', 'lesson_evaluated', 'lesson_accepted', 'lesson_persisted', 'lesson_retrieved']) {
+      const emitted = telemetry.emitLessonTelemetry({
+        event,
+        root: workspace,
+        sessionId: session,
+        candidateId: lessonId,
+        status: 'success',
+        reasonCodes: ['fixture-lifecycle'],
+      });
+      check(emitted.ok === true, 'lesson lifecycle telemetry accepts privacy-safe event: ' + event);
+    }
+    const lifecycleEvents = telemetry.readEvents(file);
+    const lifecycleReport = buildReport(lifecycleEvents);
+    check(lifecycleReport.skills.length === 1 && lifecycleReport.skills[0].skillName === 'tdd',
+      'lesson lifecycle events do not contaminate skill execution aggregates');
+    check(lifecycleReport.selfEvolve.candidateCount === 1 &&
+      lifecycleReport.selfEvolve.funnel.opportunities === 1 &&
+      lifecycleReport.selfEvolve.funnel.accepted === 1 &&
+      lifecycleReport.selfEvolve.funnel.persisted === 1 &&
+      lifecycleReport.selfEvolve.funnel.retrieved === 1,
+      'report projects one correlated self-evolve opportunity -> accepted -> persisted -> retrieved funnel');
+    const lifecycleSerialized = fs.readFileSync(file, 'utf8');
+    check(!lifecycleSerialized.includes(lessonId) && !lifecycleSerialized.includes(session),
+      'lesson telemetry hashes candidate/session identities instead of retaining raw IDs');
+
     const forbidden = telemetry.emitTelemetry({
       event: 'skill.invoke',
       host: 'claude',
@@ -173,7 +199,11 @@ async function main() {
     }
 
     const schema = JSON.parse(fs.readFileSync(path.join(ROOT, 'telemetry/schemas/event.schema.json'), 'utf8'));
-    check(schema.properties?.timing?.properties?.activeWindowMs && schema.properties?.event?.enum?.includes('tool.observed'), 'versioned telemetry schema preserves separate timing vocabulary');
+    check(schema.properties?.timing?.properties?.activeWindowMs &&
+      schema.properties?.event?.enum?.includes('tool.observed') &&
+      schema.properties?.event?.enum?.includes('learning_opportunity') &&
+      schema.properties?.event?.enum?.includes('lesson_retrieved'),
+      'versioned telemetry schema preserves timing plus self-evolve lifecycle vocabulary');
 
   } finally {
     if (priorHome === undefined) delete process.env.HARNESS_STATE_HOME;

package/grill-with-docs/ADR-FORMAT.md

@@ -22,6 +22,28 @@ Only include these when they add genuine value. Most ADRs won't need them.
 - **Considered Options** — only when the rejected alternatives are worth remembering
 - **Consequences** — only when non-obvious downstream effects need to be called out
 
+## Decision lifecycle and contract lineage
+
+Once an ADR is **accepted**, keep its decision and rationale historically stable. Do not rewrite an accepted ADR to make a later design look as though it was always the decision.
+
+Use compact metadata when the ADR participates in a behavior contract:
+
+```md
+ADR-ID: ADR-0001
+Status: proposed | accepted | deprecated | superseded by ADR-0002
+Affected requirements: REQ-001, REQ-004
+```
+
+When a later change materially changes the decision or its rationale:
+
+1. create a new sequential ADR;
+2. state the new decision and why the prior trade-off changed;
+3. mark the earlier ADR `superseded by ADR-NNNN`;
+4. update the living spec requirements affected by that decision;
+5. let the structured contract trace carry detailed ticket/test/implementation lineage.
+
+A ticket or implementation note never silently becomes the new architectural source of truth. If only implementation changes and the approved behavior/decision does not, keep the accepted ADR unchanged.
+
 ## Numbering
 
 Scan `docs/adr/` for the highest existing number and increment by one.

package/grill-with-docs/SKILL.md

@@ -4,7 +4,7 @@ description: Challenge the plan against the existing domain model, sharpen termi
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.4.0
+  version: 0.12.0
 ---
 
 # Grill With Docs (Domain Modeling & Architectural Alignment)

package/hooks/scripts/lib/learning-opportunity.js

@@ -8,6 +8,7 @@ const {
   getSessionId,
   getSessionDir,
 } = require('./harness-state');
+const { emitLessonTelemetry } = require('./telemetry');
 
 const SCHEMA_VERSION = 1;
 const TRIGGERS = new Set(['rule-of-3-recovery', 'verifier-fail-pass']);
@@ -134,6 +135,27 @@ function createLearningOpportunity(payload, input = {}) {
     updatedAt: observedAt,
   };
   atomicWriteJson(file, candidate);
+  const lifecycleReasonCodes = [...candidate.trigger.reasonCodes, `trigger:${triggerType}`];
+  emitLessonTelemetry({
+    event: 'learning_opportunity',
+    root,
+    payload,
+    sessionId,
+    candidateId,
+    observedAt,
+    status: 'success',
+    reasonCodes: lifecycleReasonCodes,
+  });
+  emitLessonTelemetry({
+    event: 'lesson_proposed',
+    root,
+    payload,
+    sessionId,
+    candidateId,
+    observedAt,
+    status: 'success',
+    reasonCodes: lifecycleReasonCodes,
+  });
   return { created: true, file, candidate };
 }
 

package/hooks/scripts/lib/telemetry.js

@@ -6,11 +6,26 @@ const path = require('path');
 const { getWorkspaceRoot, getStateRoot, getSessionDir } = require('./harness-state');
 
 const TELEMETRY_SCHEMA_VERSION = 1;
+const LESSON_EVENT_TYPES = new Set([
+  'learning_opportunity',
+  'lesson_proposed',
+  'lesson_screened',
+  'lesson_evaluated',
+  'lesson_accepted',
+  'lesson_rejected',
+  'lesson_inconclusive',
+  'lesson_persisted',
+  'lesson_retrieved',
+  'lesson_validated',
+  'lesson_regressed',
+  'lesson_superseded',
+]);
 const EVENT_TYPES = new Set([
   'skill.invoke',
   'skill.loaded',
   'skill.complete',
   'tool.observed',
+  ...LESSON_EVENT_TYPES,
 ]);
 const STATUSES = new Set(['unknown', 'success', 'failure', 'aborted']);
 const FORBIDDEN_KEYS = new Set([
@@ -102,6 +117,29 @@ function telemetryFile(root, payload) {
   return path.join(getStateRoot(root || getWorkspaceRoot(payload), payload), 'telemetry', 'events.jsonl');
 }
 
+function emitLessonTelemetry(input = {}) {
+  const event = String(input.event || '');
+  if (!LESSON_EVENT_TYPES.has(event)) {
+    return { ok: false, error: `unsupported lesson telemetry event: ${event}`, overheadMs: 0 };
+  }
+  const invocationId = localId('lesson', input.candidateId);
+  if (!invocationId) {
+    return { ok: false, error: 'lesson telemetry requires candidateId', overheadMs: 0 };
+  }
+  return emitTelemetry({
+    event,
+    host: ['claude', 'codex', 'opencode', 'unknown'].includes(input.host)
+      ? input.host
+      : detectHost(input.payload || {}),
+    observedAt: input.observedAt || nowIso(),
+    sessionId: localId('session', input.sessionId),
+    invocationId,
+    skillName: 'self-evolve',
+    status: STATUSES.has(input.status) ? input.status : 'unknown',
+    reasonCodes: input.reasonCodes || [],
+  }, { root: input.root, payload: input.payload });
+}
+
 function emitTelemetry(input, options = {}) {
   const started = process.hrtime.bigint();
   try {
@@ -361,9 +399,11 @@ function readEvents(file) {
 module.exports = {
   EVENT_TYPES,
   FORBIDDEN_KEYS,
+  LESSON_EVENT_TYPES,
   STATUSES,
   TELEMETRY_SCHEMA_VERSION,
   detectHost,
+  emitLessonTelemetry,
   emitTelemetry,
   hostDuration,
   localId,

package/hooks/scripts/lib/workflow-runtime.js

@@ -162,6 +162,23 @@ function settleMutationProbe(context, key, afterFingerprint, tool) {
   });
 }
 
+function settleMutationProbeConservative(context, key, tool, evidence = 'unobservable-workspace') {
+  return withMutationProbeLock(context, () => {
+    const file = mutationProbeFile(context, key);
+    const probe = readJson(file);
+    if (!probe || probe.schemaVersion !== 1) return null;
+    refreshWorkflowForProbe(context);
+    fs.unlinkSync(file);
+    context.workflow.lastMutationAt = Date.now();
+    if (probe.reserveIteration && context.workflow.strategy === 'iterative-single') {
+      recordBudgetEvent(context, 'iteration', { evidence: String(tool || 'shell') + ':' + evidence });
+    } else {
+      saveWorkflow(context);
+    }
+    return { changed: true, probe, conservative: true };
+  });
+}
+
 function discardMutationProbe(context, key) {
   return withMutationProbeLock(context, () => {
     const file = mutationProbeFile(context, key);
@@ -396,4 +413,4 @@ function readHookInput(decide) {
   process.stdin.on('error', finish);
 }
 
-module.exports = { OPEN_STATES, SAFE_ID, WORKFLOW_CONTROLLER_COMMANDS, isMajorWorkflow, loadWorkflow, saveWorkflow, budgetLimits, ensureWorkflowBudget, mutationProbeReservations, assertIterationCapacity, registerMutationProbe, peekMutationProbe, settleMutationProbe, discardMutationProbe, clearMutationProbes, recordBudgetEvent, resetWorkflowBudget, syncBudgetToRun, matchingRun, unresolvedStages, readHookInput };
+module.exports = { OPEN_STATES, SAFE_ID, WORKFLOW_CONTROLLER_COMMANDS, isMajorWorkflow, loadWorkflow, saveWorkflow, budgetLimits, ensureWorkflowBudget, mutationProbeReservations, assertIterationCapacity, registerMutationProbe, peekMutationProbe, settleMutationProbe, settleMutationProbeConservative, discardMutationProbe, clearMutationProbes, recordBudgetEvent, resetWorkflowBudget, syncBudgetToRun, matchingRun, unresolvedStages, readHookInput };

package/hooks/scripts/state-persist.js

@@ -2,7 +2,7 @@
 const fs = require('fs');
 const path = require('path');
 const { getWorkspaceRoot, getSessionDir } = require('./lib/harness-state');
-const { loadWorkflow, saveWorkflow, peekMutationProbe, settleMutationProbe } = require('./lib/workflow-runtime');
+const { loadWorkflow, saveWorkflow, isMajorWorkflow, peekMutationProbe, settleMutationProbe, settleMutationProbeConservative } = require('./lib/workflow-runtime');
 const { cwdOf, shellProbeKey, workspaceFingerprint, directMutationInWorkspace } = require('./lib/workflow-isolation');
 const { observeTool } = require('./lib/telemetry');
 
@@ -42,6 +42,10 @@ function observeWorkspaceMutation(payload, root) {
   try {
     after = workspaceFingerprint(cwd);
   } catch (error) {
+    if (!isMajorWorkflow(context.workflow)) {
+      const conservative = settleMutationProbeConservative(context, probeKey, toolName, 'unobservable-workspace');
+      return Boolean(conservative && conservative.changed);
+    }
     context.workflow.state = 'blocked';
     context.workflow.blockReason = 'mutation-observation-failed';
     saveWorkflow(context);